Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add forefy/.context --skill self-improvegit clone --depth 1 https://github.com/forefy/.contextWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forefy/.context/self-improve)<a href="https://agentmods.dev/skills/forefy/.context/self-improve"><img src="https://agentmods.dev/badge/skills/forefy/.context/self-improve/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/forefy/.context/self-improve"><img src="https://agentmods.dev/badge/skills/forefy/.context/self-improve.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.00831 |
| Opus 5 | $0.00030 | $0.00415 |
| Sonnet 5 | $0.00012 | $0.00166 |
| Haiku 4.5 | $0.00006 | $0.00083 |
Grade A, and why
self-improve scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Every run that invokes this skill should leave the next run better off than the last, by pushing what was learned back through the git source this skill is hosted at.
A lesson that stays in the conversation dies with the context window. A lesson written into a skill, a memory file, or a doc is the only kind that survives.
Task definition
Audit the conversation and the project to find opportunities to improve how work is done here. Reflect on what was actually done, where it went wrong, and where it could have been done better.
What counts as an improvement:
- Continuation. A fresh context loading this repo to do the same task hits the same pitfalls unless something in the repo changes. Removing that repeat cost is the highest-value improvement available.
- Correct work rather than a workaround that grows more painful as the project does.
- Updates to project memory, skills and docs that generalize past the single case that prompted them.
What does not count:
- Changes that do not align with the project's long-term direction.
- Overbuilding something that does not merit it on a second look.
- Anything that trades away UX, security or reliability.
Method
- Review the conversation for corrections, retries, and dead ends. Each one is a candidate.
- Separate the one-off from the generalizable. Only the generalizable is worth writing down.
- Find the right home for each lesson. A rule about this repo belongs in the repo. A rule about how the agent works belongs in a skill. A fact that is not derivable from the code belongs in project memory.
- Make the change, then verify it against the checks below before committing.
Pre-commit checks
- Run the tests, and add tests covering new critical functionality.
- Security review the changed code and confirm no critical issue was introduced.
- Remove leftovers before committing: dead code, scratch scripts, sensitive data, and anything that pollutes history. History is effectively permanent, so this is both a professionalism and a security matter.
- Write short, accurate, human commit messages.
- Push to the working branch only with approval and at high confidence that nothing breaks.
- Planning notes, changelogs and scratch markdown files are often not useful to other developers. Ask the user before committing them, and delete them when they are not wanted.
- Before committing, check as far as possible that the change works and broke nothing.
- Commit no personal files, PII or names without explicit approval. Code must stay portable, with no hardcoded user paths or emails. Personal values belong in environment secrets if they belong anywhere.
- Replace em dashes with regular hyphens across the codebase, with one exception: database migration files such as
migrations/*.sqlare immutable once applied, and editing them changes their checksum and breaks deploys. - Confirm any changed frontend component is screen-adaptive.
- Check that a fix made for the local environment also holds where it is deployed. A missing dependency resolved locally needs the deployment path to handle it too.
- Update the project's documentation where it is managed, whether that is in-repo docs or an external system.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · -1 lines a3a74a5572ba
- 9d ago First seen · 61 lines · 60 tokens per session scan A 51e652fbb88a
self-improve is a skill published in the GitHub repository forefy/.context (146 stars, last pushed 3d ago), licensed MIT. It adds 60 tokens to every session and 831 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
eresus-manual-security-audit
Elite manual security code review skill for deep, adversarial vulnerability hunting and exploit-chain discovery. Trigger when the user asks to: "do a deep security audit", "manual code review", "find exploit chains", "hunt for logic bugs", "red-team this codebase", "do an offensive security review", "review this like…
eresus-php-audit
Deep PHP-specific security audit skill covering injection, deserialization, file operations, auth bypass, POP chain discovery, and CMS-specific patterns. Trigger when auditing PHP code: "audit this PHP app", "find PHP security issues", "check Laravel/WordPress for vulnerabilities", "PHP SAST review", "check for PHP…
eresus-sast-scanner
General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis. Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find security bugs", "do a SAST scan", "check for [vulnerability type] in code", "audit source code", or requests a security code…
eresus-python-audit
Deep Python-specific security audit skill with 50+ vulnerability class coverage across 7 categories. Trigger when auditing Python code: "audit this Python app", "find Python security issues", "check Flask/Django for vulnerabilities", "Python SAST review", "check for pickle vulnerabilities", "review this FastAPI code".…
eresus-remediator
Security remediation skill for fixing confirmed or likely SAST findings in source code. Trigger when the user asks to: "fix a vulnerability", "patch this security bug", "remediate SAST findings", "harden this endpoint", "make this auth flow safe", or wants code changes that remove a confirmed security issue while…
eresus-variant-analysis
GHSA/CVE variant analysis workflow for finding similar vulnerability patterns across a codebase. Trigger when the user asks to: "find variants of this CVE", "GHSA variant analysis", "find similar bugs", "hunt for the same pattern", "are there other places with this vulnerability?", or when a known vulnerability is…