Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/grcengineering/companion/practice-scenarionpx skills add grcengineering/companion --skill practice-scenariogit clone --depth 1 https://github.com/grcengineering/companionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/grcengineering/companion/practice-scenario)<a href="https://agentmods.dev/skills/grcengineering/companion/practice-scenario"><img src="https://agentmods.dev/badge/skills/grcengineering/companion/practice-scenario.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00061 | $0.00527 |
| Opus 5 | $0.00030 | $0.00264 |
| Sonnet 5 | $0.00012 | $0.00105 |
| Haiku 4.5 | $0.00006 | $0.00053 |
Grade A, and why
practice-scenario scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
practice-scenario
What
Generate realistic but fictional situations for the learner to respond to. Grade the reasoning, not just the final answer.
When
- The learner wants judgment practice.
- The learner asks for a mock scenario, case, or interview-style prompt.
- The learner needs to practise tradeoffs after learning a concept.
- The learner wants a safe substitute for a live operational request.
Not For
- Reviewing a real vendor, control, audit, policy, or programme.
- Coaching by questions before a scenario is framed. Use
socratic-coach. - Building a project artefact. Use
lab-builder.
Inputs
- Target concept or skill.
- Learner level and timebox.
- Optional corpus ideas when the scenario needs citation grounding.
Steps
- Pick a fictional organization, role, constraint, and ambiguous signal.
- State only the facts needed for the exercise.
- Ask the learner what they would do first and why.
- Let them answer before giving the stronger answer.
- Grade reasoning, assumptions, tradeoffs, and boundary awareness.
- Ask what principle transfers to another setting.
Validation
- The case is fictional and does not require sensitive details.
- Feedback names reasoning quality, not just correctness.
- The learner leaves with one transferable principle.
Gotchas
- If the learner starts describing their real case, abstract it before continuing.
- If the scenario has a single obvious answer, add an ambiguous constraint or tradeoff.
- If the learner is too new for the case, teach the prerequisite with
concept-tutorfirst.
Failure Modes
- Operational leak: remove real organizations, vendors, evidence, controls, and deadlines.
- Answer-first teaching: require the learner's attempt before giving model reasoning.
- Overloaded prompt: keep the scenario small enough for one response.
Examples
- User asks for SOC 2 practice -> Create a fictional startup with messy access review evidence and ask what signal they would inspect first.
- User wants interview prep -> Give a toy TPRM tradeoff case, grade assumptions, then ask for a revised answer.
- User asks "Should we approve this vendor?" -> Refuse the live decision and convert it into a fictional vendor reasoning scenario.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 63 lines · 61 tokens per session scan A 83e2860f4566
practice-scenario is a skill published in the GitHub repository grcengineering/companion (32 stars, last pushed 3mo ago), licensed MIT. It adds 61 tokens to every session and 527 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
control-mapping
Maps NIST controls to FedRAMP requirements and documents. Use when helping with control implementation, compliance mapping, security baseline alignment, or understanding control requirements.
frmr-analysis
Analyzes FedRAMP FRMR documents to extract control mappings, KSI entries, and version changes. Use when the user asks about FedRAMP requirements, control mappings, compliance data, or needs to understand FRMR document content.
GRC & Compliance
Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation.
servicenow-irm-grc
ServiceNow Integrated Risk Management / GRC — the ServiceNow equivalent of RSA Archer (GRC) and OneTrust (privacy). Covers Risk Management, Policy & Compliance, Audit Management, Vendor / Third-Party Risk (TPRM), and Privacy Management. Use when the agent must list open risks, roll up compliance by control state, list…
trestle-authoring-workflow
Use this skill for the Compliance Trestle authoring workflow. The workflow is the generate-edit-assemble cycle that converts OSCAL documents to markdown and back. Use it for authoring catalogs, profiles, SSPs, or component definitions. Use it for editing control markdown, YAML headers, or the roundtrip workflow…
trestle-compliance-pipeline
Use this skill for end-to-end compliance pipelines with Compliance Trestle. Topics include GRC personas, artifact ownership, multi-repository coordination, two-phase component definition authoring, CI/CD pipeline integration, and the Compliance-to-Policy (C2P) bridge. Use it for compliance pipelines, personas…