Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fending/context-engineering/scope-checknpx skills add fending/context-engineering --skill scope-checkgit clone --depth 1 https://github.com/fending/context-engineeringWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.00692 |
| Opus 5 | $0.00015 | $0.00346 |
| Sonnet 5 | $0.00006 | $0.00138 |
| Haiku 4.5 | $0.00003 | $0.00069 |
Grade A, and why
scope-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scope Check
Validate a planned task against AGENTS.md boundary rules before writing any code.
What This Skill Does
-
Build constraint list: Read AGENTS.md boundary sections ("Do NOT", "Boundaries", "Restrictions") from all applicable levels -- project root and any relevant subdirectories for the files the task will touch.
-
Compare task against constraints: For each boundary rule, assess whether the planned task could conflict. Consider both direct conflicts (task explicitly does what a rule forbids) and indirect ones (task modifies a file in a protected area, task has side effects that touch restricted scope).
-
Assess and report:
- Clear -- no boundary conflicts found. Proceed.
- Warning -- task touches areas near boundaries. Specific rules quoted with the potential conflict explained. Proceed with awareness.
- Blocked -- task directly violates one or more boundary rules. Rules quoted, conflict explained, alternatives suggested.
When to Use
- Before starting any task that touches files or areas you know have restrictions
- When a task description feels like it might conflict with project boundaries
- When working in an unfamiliar part of the codebase where you haven't read the local AGENTS.md
- As a planning step before larger changes that span multiple directories
Example Output
Checking task "add rate limiting to auth middleware" against boundaries...
Warning: AGENTS.md (project root) declares:
Do NOT modify auth middleware without explicit approval
This task directly modifies auth middleware. The boundary doesn't prohibit the change -- it requires approval before proceeding. Confirm with the project owner before starting.
Clear on all other boundaries. No subdirectory-level restrictions apply to
src/middleware/.
How It Pairs with boundary-guard
Scope-check and boundary-guard are complementary, not redundant:
- Scope-check runs at planning time, before work starts. It's proactive -- you invoke it to understand constraints before writing code.
- boundary-guard runs at execution time, on every file edit. It's reactive -- it catches violations the moment they happen, even if you didn't run scope-check first.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 56 lines · 30 tokens per session scan A 257a837bda61
scope-check is a skill published in the GitHub repository fending/context-engineering (11 stars, last pushed 5mo ago), licensed MIT. It adds 30 tokens to every session and 692 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ccc
This skill should be used when code search is needed (whether explicitly requested or as part of completing a task), when indexing the codebase after changes, or when the user asks about ccc, cocoindex-code, or the codebase index. Trigger phrases include 'search the codebase', 'find code related to', 'update the…
feature-flags-audit
Audit and inventory all feature flags declared in the Packmind codebase. Use when the user asks to list, audit, review, or inventory feature flags, asks which flags are active, wants to know what a flag gates, or asks which flags are opened to a given domain/user. Produces a synthetic markdown table with each flag…
packmind-create-standard
Guide for creating coding standards via the Packmind CLI. This skill should be used when users want to create a new coding standard (or add rules to an existing standard) that captures team conventions, best practices, or coding guidelines for distribution to GitLab Duo.
create-run-e2e-tests
Guide for writing and running new Playwright end-to-end tests in the apps/e2e-tests/ directory of the Packmind monorepo. Use this skill whenever you add or modify a spec that drives the real frontend and API — for example testing a user flow, a new page/route, a feature behind a flag, or a UI behavior end-to-end.…
working-with-pm-design-kit
This skill provides guidance for using the Packmind UI component library (@packmind/ui). It should be used when building or modifying frontend UI with PM-prefixed components, working with Chakra UI in the Packmind codebase, or when questions arise about available components, theming, or layout patterns. Triggers on…
packmind-onboard
Complete automated onboarding: analyzes codebase, creates package, and generates standards & commands via CLI. Automatic package creation when none exist, user selection when packages are available.