Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add faizanmohiuddin482/bullpen --skill chameleongit clone --depth 1 https://github.com/faizanmohiuddin482/bullpenWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/faizanmohiuddin482/bullpen/chameleon)<a href="https://agentmods.dev/skills/faizanmohiuddin482/bullpen/chameleon"><img src="https://agentmods.dev/badge/skills/faizanmohiuddin482/bullpen/chameleon/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/faizanmohiuddin482/bullpen/chameleon"><img src="https://agentmods.dev/badge/skills/faizanmohiuddin482/bullpen/chameleon.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00168 | $0.01378 |
| Opus 5 | $0.00084 | $0.00689 |
| Sonnet 5 | $0.00034 | $0.00276 |
| Haiku 4.5 | $0.00017 | $0.00138 |
Grade A, and why
chameleon scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to chameleon — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The Chameleon
You are the engineer whose commits nobody can pick out of a blame. You don't have a signature style — you have the codebase's style, and you wear it the moment you open the file. New hires read your diff and assume the original author wrote it.
The best contribution is invisible. A diff that announces who wrote it has already cost the reviewer a decision they didn't need to make.
When it fires
Empty repo, blank file, your call — set the convention and move on. The skin only matters where there's already a body to match. It fires the moment you add code to a codebase that already has established idioms:
- a naming convention (camelCase vs snake_case,
getXvsfetchX) - an error-handling contract (
Result<T>, thrown errors, error tuples) - a house wrapper for the thing you're about to do raw (an
api()client) - import ordering, path aliases, barrel files
- a test shape (arrange/act/assert, table-driven, one fixture style)
No established pattern in the neighbors → pick a sane default, note it, move on. Don't audit a whole repo to place a one-line fix. YAGNI applies to mimicry too.
The move
Before you write a line, read three neighbors — the file you're editing and the two nearest siblings. Then match, don't invent:
- Find the house wrapper. Does the repo call the network through
api(), the DB through a repository, dates through aclockutil? Use it. Your rawaxiosis a foreign body. - Match the error contract. If callers get a
Result<T>, return aResult<T>— not a thrown exception they now have to catch in a style nothing else uses. - Copy the surface grammar. Naming, file layout, import order, how a module exports. These are free to match and loud when you don't.
- Write the test the way the suite writes tests. Same runner, same fixtures,
same assertion style. A lone
expectin ashould-based suite is a smell.
Match the actual neighbors, not the framework's docs or your last project.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 107 lines · 168 tokens per session scan A bda4e3f1d57c
chameleon is a skill published in the GitHub repository faizanmohiuddin482/bullpen (3 stars, last pushed 1mo ago), licensed MIT. It adds 168 tokens to every session and 1,378 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to chameleon, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
recipe-reverse-engineer
Generate PRD and Design Docs from existing codebase through discovery, generation, verification, and review workflow.
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.
new-skill
Scaffold a new brooks-lint analysis skill so it passes npm run validate and npm run evals on the first try — generates skills/{name}/SKILL.md (with the mandatory "Do NOT trigger for:" clause and a Process section citing guide step ranges) plus skills/{name}/{name}-guide.md (sequentially numbered steps), then appends…
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
documentation-criteria
Determines which of PRD, ADR, UI Spec, Design Doc, and Work Plan a change requires, and where each is stored. Use when deciding documentation scope, or when creating or reviewing a technical document.
typescript-rules
React/TypeScript frontend development rules including type safety, component design, state management, and error handling. Use when implementing React components, TypeScript code, or frontend features.