Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add forjd/startup-ideation-skills --skill startup-problem-grillinggit clone --depth 1 https://github.com/forjd/startup-ideation-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forjd/startup-ideation-skills/startup-problem-grilling)<a href="https://agentmods.dev/skills/forjd/startup-ideation-skills/startup-problem-grilling"><img src="https://agentmods.dev/badge/skills/forjd/startup-ideation-skills/startup-problem-grilling/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/forjd/startup-ideation-skills/startup-problem-grilling"><img src="https://agentmods.dev/badge/skills/forjd/startup-ideation-skills/startup-problem-grilling.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.02091 |
| Opus 5 | $0.00015 | $0.01045 |
| Sonnet 5 | $0.00006 | $0.00418 |
| Haiku 4.5 | $0.00003 | $0.00209 |
Grade A, and why
startup-problem-grilling scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 310 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Startup Problem Grilling
When to use
Use after a startup problem has been captured in a problem ledger, or when the user asks whether a business idea is worth pursuing.
This skill is deliberately sceptical. The goal is not to kill ideas for sport; it is to find fragile assumptions before the user spends weeks building the wrong thing.
Stance
Be direct, practical, and specific. Question the problem, buyer, urgency, reachability, distribution, willingness to pay, founder fit, tarpit risk, and build scope. Avoid generic startup theatre.
Inputs to request if missing
Use the evidence packet or problem ledger if it is already in context. If it is missing, do not block useful critique when partial context is enough. Ask only the 3–5 missing questions that would most change the verdict.
Use this full ledger shape when the user wants a formal handoff from the problem ledger:
Problem:
User/persona:
When it happens:
Current workaround:
Cost of doing nothing:
Frequency:
Potential buyer:
Existing tools/alternatives:
Why now:
Founder advantage:
Distribution route:
Expansion path:
Could I reach 10 users:
Could I build v1 in 2–4 weeks:
Grilling workflow
- Restate the problem in its strongest concrete form.
- Identify the weakest 3–5 assumptions.
- Map user, buyer, blocker, budget owner, and risk owner.
- Check tarpit risk and whether distribution may be harder than product.
- Challenge pricing and willingness-to-pay early.
- Screen whether the problem is painful, specific, timely, underserved, founder-fit, and expandable.
- Score founder-market fit against the user's actual advantages.
- Suggest small validation moves that do not require building the full product.
- End with a verdict:
Promising,Needs narrowing,Weak until proven, orProbably not worth building yet. - Update the evidence packet with the verdict, weakest assumptions, and the next validation gate.
Question bank
Problem reality
- Is this painful enough that people already spend time, money, or political capital on it?
- What happens if they ignore it?
- Is it a frequent problem, a severe problem, or neither?
- Is the pain felt by the same person who would approve a fix?
- Is the current workaround hated, or merely untidy?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 310 lines · 31 tokens per session scan A c26d13036aee
startup-problem-grilling is a skill published in the GitHub repository forjd/startup-ideation-skills (2 stars, last pushed 2mo ago), licensed MIT. It adds 31 tokens to every session and 2,091 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024)…
m365-entra-attack
Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced…
password-spray-methodology
End-to-end password spray playbook. User enumeration, lockout detection, password pattern generation, spray execution across all protocols, error code differentials, and engagement discipline. Unifies M365/Entra, Okta, Exchange, Kerberos, SharePoint, XMLRPC, OIDC, and AD SMB/WinRM spraying into one methodology.
subdomain-enumeration
Map subdomains via crt.sh and subfinder at recon kickoff.
cache-attack
Poison CDN cache or deceive when X-Cache header is detected.
recon-sector
Parameterized sector recon using sector database.