Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add event4u-app/agent-config --skill history-designgit clone --depth 1 https://github.com/event4u-app/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/event4u-app/agent-config/history-design)<a href="https://agentmods.dev/skills/event4u-app/agent-config/history-design"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/history-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/event4u-app/agent-config/history-design"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/history-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.01145 |
| Opus 5 | $0.00022 | $0.00573 |
| Sonnet 5 | $0.00009 | $0.00229 |
| Haiku 4.5 | $0.00004 | $0.00114 |
Grade C, and why
history-design scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
| 1 | Row-level audit log (Laravel: spatie/activitylog or owen-it/laravel-auditing; TS: thin custom audit table) | admin panels, SaaS tenant data, "wer hat was wann geändert" | retention policy REQUIRED | <!-- md-languag How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
history-design
When to use
- A model/table is declared audit-scoped ("we need to know who changed what and when") and the mechanism must be chosen — NOT assumed.
- The user asks for an audit trail, change history, activity log, or proposes event sourcing.
- NOT for reviewing an existing migration diff (route to
schema-review) and NOT for privacy/DSR policy design (route toprivacy-review; this skill only wires the interlock).
Procedure
-
Collect the requirement facts (ask ONE question only if missing): who edits the data (single editor vs multi-tenant), compliance need (GDPR/SOC2/audit), point-in-time query need, replay/projection need, expected mutation volume.
-
Walk the tier matrix — normative, cheapest-sufficient wins:
Tier Mechanism Use when Growth control 0 updated_at/updated_bycolumnssingle-editor, no compliance need none needed 1 Row-level audit log (Laravel: spatie/activitylog or owen-it/laravel-auditing; TS: thin custom audit table) admin panels, SaaS tenant data, "wer hat was wann geändert" retention policy REQUIRED 2 DB temporal/system-versioned tables point-in-time queries needed, DB supports it partition rotation 3 Event sourcing domain genuinely event-driven, replay/projection needed snapshotting + archive REQUIRED Default tier: 1. Tier 3 requires an explicit architecture waiver from the user — never "upgrade" to event sourcing unprompted.
-
Apply the four interlocks to the chosen tier:
- Hygiene (R-B3): audit storage indexed on
(auditable_type, auditable_id, created_at); store JSON diffs, not full-row copies, where a diff suffices. - Growth (R-A7): the audit table itself declares retention (TTL, pruning job, partition rotation, or archive path) — history must not re-create the unbounded-growth problem it documents.
- Privacy (R-B4): audit records inherit the deletion/ anonymization obligations of the data they describe — a GDPR Art. 17 path must exist before the mechanism ships.
- Reliability (R-B5): audit capture is same-transaction (Tier-1 default: observer + cheap single insert — allowed request-path work) OR outbox/afterCommit with a durable queue when offloaded. A lossy audit trail is worse than none.
- Hygiene (R-B3): audit storage indexed on
-
Emit the decision artifact (Output below) and, when the tier lands, hand implementation to the stack-native path (Laravel package install + config, or the thin custom audit-table pattern for TS — no dependency needed there).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 102 lines · 43 tokens per session scan C 4eb65b971dd9
history-design is a skill published in the GitHub repository event4u-app/agent-config (10 stars, last pushed today), licensed MIT. It adds 43 tokens to every session and 1,145 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
privacy-retention-and-right-to-delete
Guides agents through privacy, retention, and deletion workflows in data systems. Use when handling personal data, retention limits, deletion requests, legal holds, or data minimization requirements across pipelines and published datasets.
data-retention-archiving-planner
Plans and implements data retention policies with archival strategies, compliance requirements, automated cleanup jobs, and cold storage migration. Use for "data retention", "data archival", "GDPR compliance", or "storage optimization".
mongodb-connection
Optimize MongoDB client connection configuration (pools, timeouts, patterns) for any supported driver language. Use this skill when working/updating/reviewing on functions that instantiate or configure a MongoDB client (eg, when calling connect()), configuring connection pools, troubleshooting connection errors…
mongodb-schema-design
MongoDB schema design patterns and anti-patterns. Use when designing data models, reviewing schemas, migrating from SQL, or troubleshooting performance issues caused by schema problems. Triggers on "design schema", "embed vs reference", "MongoDB data model", "schema review", "unbounded arrays", "one-to-many", "tree…
mongodb-search-and-ai
Guides MongoDB users through implementing and optimizing Atlas Search (full-text), Vector Search (semantic), and Hybrid Search solutions. Use this skill when users need to build search functionality for text-based queries (autocomplete, fuzzy matching, faceted search), semantic similarity (embeddings, RAG…
yuwen-publish-precheck
A Chinese-language review workflow for checking content before publishing it on Douyin, Xiaohongshu, or WeChat Channels.