Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/fledgeling-co/fledgeling-pluginsnpx agentmods add skills/fledgeling-co/fledgeling-plugins/assayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fledgeling-co/fledgeling-plugins/assay)<a href="https://agentmods.dev/skills/fledgeling-co/fledgeling-plugins/assay"><img src="https://agentmods.dev/badge/skills/fledgeling-co/fledgeling-plugins/assay/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fledgeling-co/fledgeling-plugins/assay"><img src="https://agentmods.dev/badge/skills/fledgeling-co/fledgeling-plugins/assay.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.01181 |
| Opus 5.5 | $0.00039 | $0.00472 |
| Sonnet 5.5 | $0.00019 | $0.00236 |
| Haiku 4.5 | $0.00010 | $0.00118 |
Grade A, and why
assay scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Assay — measure the tests before believing them
Every downstream number inherits the suite's fault sensitivity, and a green suite can have very
little of it. More than half of over 15,000 generated mutants survived a rigorous unit, integration
and system suite that was passing (C18). That was one company's codebase; nobody has measured
mutation survival for browser or end-to-end suites at all, which is exactly why it has to be
measured here rather than assumed from the literature.
The second reason this plane exists is subtler. A suite can pass because it is not looking. An assertion with no matcher, a matcher comparing a value to itself, a swallowed exception — each reads as coverage and tests nothing.
Running as a Gemini model? Read gemini.md in this directory first, then follow this file with the overrides it names. It replaces the mutation report's hand-typed figures with a filled delivery note per script, forbids re-running mutate.py after an exit 2, and adds the rollup receipt check without which every defect class reads as having no evidence. Other models skip it.
Procedure
-
Mutate the set CI actually runs.
python3 scripts/mutate.py --root <repo> --targets <file-list> --test-cmd '<command>'Mutate against the selected set, not the authored one. The selected set is what gates a merge, so its sensitivity is the one that matters — and in the target repository CI selects 420 of roughly 3,011 authored instances across 137 spec files (
C23), so the two numbers are far apart. The script copies to a temporary directory and never mutates the working tree.It writes
.warrant/suite-health.jsonwith a ratchet: the score may rise and the high-water mark rises with it, and a drop below the mark exits 2. -
Scan for assertions that cannot fail.
python3 scripts/cannotfail_scan.py --root <repo> --glob 'apps/web/e2e/**/*.spec.ts'Eight patterns, each of which passes a suite while testing nothing: an
expect(...)with no matcher; a matcher whose expected value is the actual value; a constant compared to a constant; acatchblock that swallows the failure; an assertion inside a callback that is never awaited;test.skipandtest.todo; a discardedexpect.soft; and a spec file with zeroexpectcalls.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 5d8e47bf06dd
- 1mo ago First seen · 104 lines · 97 tokens per session scan A 2f3bf1b19c8e
assay is a skill published in the GitHub repository fledgeling-co/fledgeling-plugins (2 stars, last pushed 4d ago), licensed MIT. It adds 97 tokens to every session and 1,181 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
testing
Skill validation framework PLUS daily test-suite health and regression intelligence. Validates skill conformance (frontmatter, manifest coverage, resolver coverage). Runs the project test suite in tiered phases (unit / evals / integration / system health), classifies failures, and produces a regression-aware report.
verify
Verify that a change really works before you claim completion.
detect-static-dependencies
ACTIVATION PREREQUISITE: the request or discovered target must explicitly identify C#, .NET, .cs, or .csproj; otherwise stay dormant without invoking this skill. USE FOR: locating System.DateTime.Now/UtcNow, System.IO.File/Directory, System.Environment, HttpClient, Console, or Process usage in C#; auditing C# code for…
dart-downstream-fix
DART Downstream Fix: fix a DART bug reported through gz-physics or Gazebo.
testing-blocks
Use this when you have made AEM Edge Delivery Services code changes to blocks, scripts, or styles and need to validate them before opening a pull request. Covers unit testing for utilities and logic, browser testing with Playwright, linting, and guidance on what to test and how.
experiment-iterative-coder
Iterative code refinement through plan → code → evaluate → refine cycles. Runs lint checks (ruff), tests (pytest), and structured self-evaluation each cycle, then diagnoses failures and refines. Decomposes complex tasks into sequential phases, iterates up to 3 times per phase (10 total). Use when: the main agent…