Borrowing it
Nothing to install: this file belongs to go-to-k/cdkd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/go-to-k/cdkd/main/.claude/skills/run-integ/SKILL.mdgit clone --depth 1 https://github.com/go-to-k/cdkdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go-to-k/cdkd/run-integ)<a href="https://agentmods.dev/skills/go-to-k/cdkd/run-integ"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/run-integ/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/go-to-k/cdkd/run-integ"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/run-integ.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 154 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 354 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 356 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.06617 |
| Opus 5.5 | $0.00014 | $0.02647 |
| Sonnet 5.5 | $0.00007 | $0.01323 |
| Haiku 4.5 | $0.00003 | $0.00662 |
Grade C, and why
run-integ scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
will not clear it — run with that override, then `rm -rf` the dir (an ECR Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
name which is down first: `curl` the registry from the HOST, `curl` it from How it starts
The opening of the file, as written. The whole thing — 426 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Integration Test Runner
Run integration tests against a real AWS account: deploy actual resources, verify, clean up.
Arguments
test-name: which test (seels tests/integration/). If unspecified, ask viaAskUserQuestionshowing the options.all: run all tests--synth-only: synthesis only, skip deploy/destroy--no-destroy: deploy but don't destroy (debugging)--deploy-args "<args>": forward extra args to thecdkd deployinvocation verbatim (destroy is unaffected).
Steps
-
Rebase, then build:
git fetch originand rebase onto currentorigin/main(merge it when a force push is denied) BEFORE the run — a stale base verifies code other than what will merge, and nothing warns. Thenvp run buildsodist/is current. Never build beside a live fixture in this tree: any build (/check,/verify-pr,vp run verify,vp run runtime:smoke, a building fixture, …) rewritesdist/, and the fixture's nextnode dist/cli.js(its cleanup trap's too) diesERR_MODULE_NOT_FOUND. In a set, run each building fixture (grep -lE '^\s*\(cd [^)]*&& vp run build[ )]' <dir>/*.sh; a barevp run buildalso matches error text) alone, BEFORE the others. After a build beside a live run, re-scan per steps 6-7, record that fixtureFAIL, and re-run it. -
List available tests:
ls tests/integration/— never a hardcoded list. -
Determine state bucket: account via
aws sts get-caller-identity --query Account --output text, thencdkd-state-{accountId}(region-free default). If absent, fall back to the legacycdkd-state-{accountId}-us-east-1and note the deprecation. -
Pre-flight orphan scan (mandatory): a prior run killed mid-deploy leaves orphans matching the stack about to deploy, and cdkd's diff does not see them, so the deploy attempts CREATE and collides. Pick the region first:
us-east-1, unless the fixture'sverify.shheader names a constraint; its last ledger note shows a region that passed. In a parallel set, each fixture whose header has aSAFETY NOTE(bootstrap-marker or asset-storage ownership, #4063) gets its OWN region, probed for what that header needs absent or present, passed viaAWS_REGIONor the header's region variable. A fixture that runscdkd gcruns ALONE, after the set: gc refuses while ANY stack holds a lock, its batch-mates' included. Every resource-scan--region,AWS_REGIONand synth/deploy/destroy--regionin steps 4-7 then uses the fixture's region. Synth first (for the stack name and resource types), then scan:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +3 lines 93b64a8805a1
- 9d ago Changed · +5 lines 9e02f0ce319c
- 10d ago Changed · +2 lines fef0ac9dd358
- 12d ago Changed · -2 lines 01819bf38e41
- 14d ago Changed · +4 lines 2cd608a25386
- 18d ago Changed 4317f60a0159
- 20d ago Changed 4fa9125a9786
- 21d ago Changed · +9 lines 8b0e62d52f2e
- 23d ago Changed · +2 lines 624a88d9fa6a
- 24d ago First seen · 403 lines · 34 tokens per session scan C 708bf0c52b5d
run-integ is a skill published in the GitHub repository go-to-k/cdkd (156 stars, last pushed today), licensed Apache-2.0. It adds 34 tokens to every session and 6,617 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
testing-patterns
Skill "testing-patterns" from seandkendall/kiro-config, covering testing patterns, python lambda test (pytest + moto), react component test (vitest + rtl), coverage commands and playwright quick reference.
aws-cdk-mcp-server-mcp
AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.
aws-testing
Testing strategies for AWS workloads. Use when writing unit tests, integration tests, contract tests, mocking AWS services, or setting up quality gates and CI/CD test pipelines.
python-runtime
Python toolchain configuration and best practices. Use when setting up Ruff, pytest, mypy type hints, dependency management, virtual environments or Python project standards.
playwright
Playwright E2E testing patterns. Trigger: When writing Playwright E2E tests (Page Object Model, selectors, MCP exploration workflow). For Prowler-specific UI conventions under ui/tests, also use prowler-test-ui.
prowler-test-sdk
Testing patterns for Prowler SDK (Python). Trigger: When writing tests for the Prowler SDK (checks/services/providers), including provider-specific mocking rules (moto for AWS only).