Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/go-to-k/cdkd/pick-integnpx skills add go-to-k/cdkd --skill pick-integgit clone --depth 1 https://github.com/go-to-k/cdkdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go-to-k/cdkd/pick-integ)<a href="https://agentmods.dev/skills/go-to-k/cdkd/pick-integ"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/pick-integ.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02960 |
| Opus 5 | $0.00034 | $0.01480 |
| Sonnet 5 | $0.00014 | $0.00592 |
| Haiku 4.5 | $0.00007 | $0.00296 |
Grade A, and why
pick-integ scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Integ Test Picker
Decide which integration tests to run right now, ranked by two signals: how
stale the last run is (from the committed ledger) and whether recent changes
touch the area a test exercises. It RECOMMENDS only; the orchestrator runs
the chosen tests via /run-integ.
The ranking is a running ORDER, not a budget (CLAUDE.md → "Cost is not a tiebreaker"): when several tests plausibly cover the touched code, run all of them, and prefer a broad-set fixture whenever the change is cross-cutting. Priorities decide what runs FIRST; a plan too long for one session is handed forward per "Running a large plan across sessions" — never silently truncated, and the wrap-up names exactly which tests were not run.
Inputs
- Optional positional
base-ref(defaultorigin/main): the diff base. Use the last release tag when picking post-merge;origin/mainfor a branch.
Data sources
-
Ledger
docs/_generated/integ-last-run.tsv(committed, one row per test; written by/run-integon every run):- Stale: age > the integ-gate TTL (14 days) — past that the gate markers expire, so a clean result no longer proves today's AWS behavior.
- Expiring soon: age 12–14d. The ledger accumulates in
sweep-shaped cohorts (one sweep stamps 100+ rows with one timestamp), so
a strict
>14dboolean answers "nothing" or "everything" — always report this tier; "zero stale" is misleading when 105 tests cross the TTL tomorrow (issue #1508). - Failing:
result == FAIL— always a candidate. - Never-run: a fixture directory with NO ledger row — highest staleness.
-
Recent changes:
git diff <base-ref>...HEAD --name-only, mapped to tests via the table below.
Steps
- Discover the universe + ledger state:
(TheLEDGER="docs/_generated/integ-last-run.tsv" now=$(date -u +%s) # Union-merge can leave duplicate rows — LAST row per test wins. The # header is MULTIPLE `#` lines; skip them all (a single NR==1 guard let # later header lines through as phantom stale rows). DEDUPED="$(mktemp)" awk -F'\t' '/^#/{next} {last[$1]=$0} END{for (t in last) print last[t]}' "$LEDGER" > "$DEDUPED" # never-run: fixtures with no ledger row comm -23 \ <(ls -d tests/integration/*/ | sed 's#tests/integration/##;s#/##' | sort) \ <(awk -F'\t' '{print $1}' "$DEDUPED" | sort) # resolve each row's age ONCE, then slice for the views below. AGES="$(mktemp)" awk -F'\t' -v now="$now" '{ cmd="date -u -j -f %Y-%m-%dT%H:%M:%SZ \""$2"\" +%s 2>/dev/null || date -u -d \""$2"\" +%s 2>/dev/null"; cmd | getline t; close(cmd); printf "%s\t%d\t%s\t%s\n",$1,int((now-t)/86400),$3,$6 }' "$DEDUPED" > "$AGES" # age histogram — makes a clustered cohort visible even when NOTHING is >14d awk -F'\t' '{print $2}' "$AGES" | sort -n | uniq -c | awk '{printf "%6d tests at age %sd%s\n",$1,$2,($2>14?" <-- STALE":($2>=12?" <-- crosses the TTL in "(15-$2)"d":""))}' # stale (>14d) or failing: awk -F'\t' '$3=="FAIL" || $2>14 {printf "%s\tage=%sd\tresult=%s\t%s\n",$1,$2,$3,$4}' "$AGES" # expiring soon (12-14d, not already failing) — the cliff cohort: awk -F'\t' '$2>=12 && $2<=14 && $3!="FAIL" {printf "%s\tage=%sd\texpires in %dd\n",$1,$2,15-$2}' "$AGES" # one-line cliff summary for the step 4 header: awk -F'\t' '$2>=12 && $2<=14 {n[15-$2]++} END{for (d in n) printf "%d\t%d tests expire in %dd\n",d,n[d],d}' "$AGES" | sort -n | cut -f2-dateline handles both BSD/macOS-j -fand GNU-d.)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +17 lines 00299dcabf31
- 2d ago Changed · -15 lines b0463789f2f5
- 6d ago First seen · 180 lines · 68 tokens per session scan A 335ab9dc3826
pick-integ is a skill published in the GitHub repository go-to-k/cdkd (135 stars, last pushed today), licensed Apache-2.0. It adds 68 tokens to every session and 2,960 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aws-cdk-mcp-server-mcp
AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.
agent-squad-python
Use when building or modifying a Python app that uses the agent-squad Python package — async multi-agent orchestration for Python 3.11+: orchestrator, agents (BedrockLLMAgent, AnthropicAgent, OpenAIAgent, SupervisorAgent, GroundedAgent, ChainAgent, and more), classifier routing (Bedrock, Anthropic, OpenAI), storage…
agent-squad-typescript
Use when building or modifying a Node.js / TypeScript app that uses the agent-squad npm package — multi-agent orchestration: orchestrator, agents (all built-in types + GroundedAgent), classifier routing (Bedrock / Anthropic / OpenAI), storage (in-memory / DynamoDB / SQL), retrievers (Amazon KB / Dakera), and tools…
agent-squad-swift
Use when building or modifying a Swift app that uses the AgentSquad Swift framework — on-device multi-agent orchestration for iOS 16+ / macOS 14+: orchestrator, agents (Agent, GroundedAgent), classifier routing, LLM clients (OpenAI-compatible), tools (native + MCP), tool UIs/widgets, on-device storage, tracing, and…
nx-plugin-for-aws
Scaffold and build cloud-native applications on AWS using @aws/nx-plugin generators. Use when the user wants to create workspaces, generate projects, or scaffold infrastructure with the Nx Plugin for AWS.
aws-cdk-development
AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python. Use when creating CDK stacks, defining CDK constructs, implementing infrastructure as code, or when the user mentions CDK, CloudFormation, IaC, cdk synth, cdk deploy, or wants to define AWS infrastructure programmatically.…