Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add getpapi/papi --skill papi-buildgit clone --depth 1 https://github.com/getpapi/papiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/getpapi/papi/papi-build)<a href="https://agentmods.dev/skills/getpapi/papi/papi-build"><img src="https://agentmods.dev/badge/skills/getpapi/papi/papi-build/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/getpapi/papi/papi-build"><img src="https://agentmods.dev/badge/skills/getpapi/papi/papi-build.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.02029 |
| Opus 5.5 | $0.00010 | $0.00812 |
| Sonnet 5.5 | $0.00005 | $0.00406 |
| Haiku 4.5 | $0.00003 | $0.00203 |
Grade A, and why
papi-build scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
papi-build
For missing evidence on an existing shipped task, follow papi-plan's Already-shipped work with missing evidence route. Ordinary build completion is for actual implementation; evidence restoration preserves assignment and historical cycle and does not count a new build.
Completion authority before scheduling or building
Read the task's complete scope, structured completionAction, dependencies and assignee before proposing a task set or starting work. When scope requires final decision resolution, read the actual decision and persist its structured link through board_edit before scheduling. For action: resolve, name the remaining decision action and its current authorized resolver using the canonical decision policy. Owner, per-type and group-quorum permissions must be revalidated at plan apply and task claim; unknown authority refuses final completion. Arbitrary notes, caller-reported retry guidance and a prepared proposal are not permission or human acceptance.
Keep proposal preparation in a separate action: prepare task and retain its completed output. Hand the final action: resolve task to an authorized resolver only after explicit assignment confirmation. Do not recommend rebuilding Done/In Review preparation. An optional manual approval blocks release only when a task has an explicit dependency or typed blocker.
Reconcile board assignment with branch/PR contents. Transferring tasks or creating a branch at an already merged commit cannot remove those tasks from the original PR's historical diff. Disclose already-merged scope, preserve recipient commits and approval attribution, and use a scoped corrective change when needed; never rewrite shared main or force-push a teammate's branch to claim separation.
Cycle PR preparation
Follow the owning repository's actual branch, qualification and release contract. Read its workflow before selecting checks; PAPI maintainer scripts are not requirements for customer projects. Finish authorized metadata before qualifying the final tree once, and rerun affected checks after substantive changes. Record the exact head and evidence. Never treat local-only commits as shipped.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 133 lines · 26 tokens per session scan A 4483be674293
papi-build is a skill published in the GitHub repository getpapi/papi (11 stars, last pushed today), licensed MIT. It adds 26 tokens to every session and 2,029 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.
Other skills, from other repositories
memorix-git-memory
Use when the task depends on commit history, what changed, when a fix shipped, or linking engineering evidence to reasoning memory.
work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
chinese-commit-conventions
A Chinese-language guide to Conventional Commits, a format for writing consistent Git commit messages, plus related changelog, commit-checking, and commit-helper configuration.
github-workflow
GitHub best practices for pull requests, code reviews, issues, Actions workflows, and repository management.
lerna
Best practices for Lerna monorepo management, versioning, and publishing.
ijfw-ship
Use when the user says 'ship it', 'ship this', 'release', 'publish', 'launch', 'deploy', 'go live', 'wrap this up', 'time to ship', or invokes '/ijfw-ship'. Domain-aware release — software (test → tag → push → publish), book (final edit → format → KDP / agent / Substack), campaign (review → schedule → launch →…