Borrowing it
Nothing to install: this file belongs to go-to-k/cdkd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/go-to-k/cdkd/main/.claude/skills/pick-integ/SKILL.mdgit clone --depth 1 https://github.com/go-to-k/cdkdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go-to-k/cdkd/pick-integ)<a href="https://agentmods.dev/skills/go-to-k/cdkd/pick-integ"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/pick-integ/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/go-to-k/cdkd/pick-integ"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/pick-integ.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02928 |
| Opus 5.5 | $0.00027 | $0.01171 |
| Sonnet 5.5 | $0.00014 | $0.00586 |
| Haiku 4.5 | $0.00007 | $0.00293 |
Grade A, and why
pick-integ scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Integ Test Picker
Decide which integration tests to run right now, ranked by two signals: how
stale the last run is (from the committed ledger) and whether recent changes
touch the area a test exercises. It RECOMMENDS only; the orchestrator runs
the chosen tests via /run-integ.
The ranking is a running ORDER, not a budget (AGENTS.md → "Cost is not a tiebreaker"): when several tests plausibly cover the touched code, run all of them, and prefer a broad-set fixture whenever the change is cross-cutting. Priorities decide what runs FIRST; a plan too long for one session is handed forward per "Running a large plan across sessions" — never silently truncated, and the wrap-up names exactly which tests were not run.
Inputs
- Optional positional
base-ref(defaultorigin/main): the diff base. Use the last release tag when picking post-merge;origin/mainfor a branch.
Data sources
-
Ledger
docs/_generated/integ-last-run.tsv(committed, one row per test; written by/run-integon every run):- Stale: age > the
integ-destroygate TTL (14 days) — past that the marker expires, so a clean result no longer proves today's AWS behavior. - Expiring soon: age 12–14d. The ledger accumulates in sweep-shaped
cohorts (one sweep stamps many rows with one timestamp), so a strict
>14dboolean answers "nothing" or "everything" — always report this tier. - Failing:
result == FAIL— always a candidate. - Never-run: a fixture directory with NO ledger row — highest staleness.
- Stale: age > the
-
Recent changes:
git diff <base-ref>...HEAD --name-only, mapped to tests via the table below.
Steps
- Discover the universe + ledger state:
(TheLEDGER="docs/_generated/integ-last-run.tsv" now=$(date -u +%s) # Union-merge can leave duplicate rows — LAST row per test wins. The # header is MULTIPLE `#` lines; skip them all (a single NR==1 guard let # later header lines through as phantom stale rows). DEDUPED="$(mktemp)" awk -F'\t' '/^#/{next} {last[$1]=$0} END{for (t in last) print last[t]}' "$LEDGER" > "$DEDUPED" # never-run: fixtures with no ledger row comm -23 \ <(ls -d tests/integration/*/ | sed 's#tests/integration/##;s#/##' | sort) \ <(awk -F'\t' '{print $1}' "$DEDUPED" | sort) # resolve each row's age ONCE, then slice for the views below. AGES="$(mktemp)" awk -F'\t' -v now="$now" '{ cmd="date -u -j -f %Y-%m-%dT%H:%M:%SZ \""$2"\" +%s 2>/dev/null || date -u -d \""$2"\" +%s 2>/dev/null"; cmd | getline t; close(cmd); printf "%s\t%d\t%s\t%s\n",$1,int((now-t)/86400),$3,$6 }' "$DEDUPED" > "$AGES" # age histogram — makes a clustered cohort visible even when NOTHING is >14d awk -F'\t' '{print $2}' "$AGES" | sort -n | uniq -c | awk '{printf "%6d tests at age %sd%s\n",$1,$2,($2>14?" <-- STALE":($2>=12?" <-- crosses the TTL in "(15-$2)"d":""))}' # stale (>14d) or failing: awk -F'\t' '$3=="FAIL" || $2>14 {printf "%s\tage=%sd\tresult=%s\t%s\n",$1,$2,$3,$4}' "$AGES" # expiring soon (12-14d, not already failing) — the cliff cohort: awk -F'\t' '$2>=12 && $2<=14 && $3!="FAIL" {printf "%s\tage=%sd\texpires in %dd\n",$1,$2,15-$2}' "$AGES" # one-line cliff summary for the step 4 header: awk -F'\t' '$2>=12 && $2<=14 {n[15-$2]++} END{for (d in n) printf "%d\t%d tests expire in %dd\n",d,n[d],d}' "$AGES" | sort -n | cut -f2-dateline handles both BSD/macOS-j -fand GNU-d.)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · -7 lines 32921e6ca7e7
- 27d ago Changed b4fe97341fec
- 28d ago Changed 45373cae602a
- 29d ago Changed fcb1249ee785
- 1mo ago Changed · -1 lines 53f26032d215
- 1mo ago Changed · -2 lines b58c2ec162b2
- 1mo ago Changed · -6 lines 1ed8367dc52d
- 1mo ago Changed · +2 lines 98c8e0bd5015
- 1mo ago Changed · +8 lines ef9233c65011
- 1mo ago First seen · 182 lines · 68 tokens per session scan A 9c8b7ccf7afb
pick-integ is a skill published in the GitHub repository go-to-k/cdkd (156 stars, last pushed today), licensed Apache-2.0. It adds 68 tokens to every session and 2,928 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
testing-patterns
Skill "testing-patterns" from seandkendall/kiro-config, covering testing patterns, python lambda test (pytest + moto), react component test (vitest + rtl), coverage commands and playwright quick reference.
aws-cdk-mcp-server-mcp
AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.
aws-testing
Testing strategies for AWS workloads. Use when writing unit tests, integration tests, contract tests, mocking AWS services, or setting up quality gates and CI/CD test pipelines.
python-runtime
Python toolchain configuration and best practices. Use when setting up Ruff, pytest, mypy type hints, dependency management, virtual environments or Python project standards.
playwright
Playwright E2E testing patterns. Trigger: When writing Playwright E2E tests (Page Object Model, selectors, MCP exploration workflow). For Prowler-specific UI conventions under ui/tests, also use prowler-test-ui.
prowler-test-sdk
Testing patterns for Prowler SDK (Python). Trigger: When writing tests for the Prowler SDK (checks/services/providers), including provider-specific mocking rules (moto for AWS only).