Borrowing it
Nothing to install: this file belongs to hachej/boring-ui. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hachej/boring-ui/main/.agents/skills/exec/SKILL.mdgit clone --depth 1 https://github.com/hachej/boring-uiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hachej/boring-ui/exec)<a href="https://agentmods.dev/skills/hachej/boring-ui/exec"><img src="https://agentmods.dev/badge/skills/hachej/boring-ui/exec.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.01125 |
| Opus 5 | $0.00009 | $0.00562 |
| Sonnet 5 | $0.00004 | $0.00225 |
| Haiku 4.5 | $0.00002 | $0.00112 |
Grade A, and why
exec scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
same origin, same click path — proven by an automated run (Playwright/curl) How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Exec
Drive one executable TODO, plan, Beads epic, or validated UI packet to
ready-for-human; never merge.
Read the artifact, docs/procedures/boring-loop.md, and
docs/procedures/MODEL-CARD.md. Load only the needed procedure:
- worktrees/delegation:
docs/procedures/worktree-agent.md - proof:
docs/procedures/proof-of-work.md - UI packets:
docs/procedures/visual-review.md - handoff:
docs/procedures/owner-review-card.md - provider method:
../../skill-references/exec/index.md
Require clear scope, acceptance, proof, dependencies, and risk; repair planning
gaps through /skill:plan and stop on unresolved human intent. Workers pull
their own work — never wait to be assigned a specific bead: discover with
br ready --label epic:<key> --unassigned (or br ready --json outside an
epic), claim exactly one with br update <id> --claim --actor <own session id>
(the host states your session id in the dispatch brief) — never work
unclaimed. You work in the shared epic worktree; if it already holds
uncommitted edits from a dead peer, inspect them, adopt what is correct, and
say so in the handoff rather than reverting. Stage only the files your bead
intends to touch. Refresh the lease as you work (any br touch counts;
cadence key beadle.lease_heartbeat_minutes); poll long waits synchronously
so the heartbeat keeps beating. Never end a turn waiting for an event you did
not schedule a wake-up for. Never delegate work that carries a stop-and-ask
gate to a sub-agent — the sub-agent inherits the gate but cannot verify who
satisfies it (escalate gates up, never down). Syntax that bites: br comments add <id> -m "..." (plural, id first) and --assignee (no -a on update); a
failed comment is a lost heartbeat — check exit status.
Owner demo/retest gate: before inviting the owner to test (or RE-test) a live surface, the exact reported action must pass in that exact environment — same origin, same click path — proven by an automated run (Playwright/curl) with a screenshot. Fixes that live on other branches get cherry-picked into the demo environment first. "Should work now" is never grounds for an invite; a wasted owner test is a factory defect.
Implement the smallest bounded slice with behavior tests, record current proof,
apply the Model Card review ladder and mandatory code-thermo gate, and integrate
or disposition every material finding. Re-prove and re-review non-trivial fixes.
Commit with subject [Feature Name] <imperative summary> (br-<id>) per
docs/procedures/naming-conventions.md, and push the epic branch immediately
after each commit and before creating a sandbox — remote sandboxes test the
pushed SHA, never uncommitted state. Fix forward only: never rewrite history on the epic branch — no git reset, no --amend or rebase of a commit that has been pushed, no force push; a mistake gets a new commit, and a handoff names only SHAs that exist on origin. Run tests/builds in the dedicated
exact-SHA sandbox (sandbox + sandbox_bash), verifying the sandbox actually
holds your SHA (.factory-sha or git rev-parse HEAD) before trusting its
result. Obtain an adversarial fresh_review bound to that exact SHA and
record its provenance (session, model, brief digest).
Your handoff is a Bead comment, not a PR: [Feature Name] handoff · <bead id> · <short sha> naming the SHA, your proof, the sandbox release, the
fresh_review provenance, and any residuals. You never open a PR, never run
ask_user, never raise an owner card, and never close or merge your own
bead — the epic PR, the owner demo, and both gates belong to the Orchestrator
at Gate 2 (/skill:owner-gate), not to you. Keep the lease heartbeat sentence
above in force until the handoff comment lands. Follow
.agents/skills/handoff/SKILL.md's show-me rule: a multi-file Bead's handoff
comment carries one diff-shaped show-me view of what changed.
For a UI packet, validate it first and follow the complete round, stop, baseline,
and Inbox rules in visual-review.md; the packet grants no edit or merge
authority.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +14 lines 248eae90f7c6
- 3d ago First seen · 64 lines · 18 tokens per session scan A d4c358d6c93d
exec is a skill published in the GitHub repository hachej/boring-ui (46 stars, last pushed today), licensed MIT. It adds 18 tokens to every session and 1,125 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
recipe-create-meet-space
Create a Google Meet meeting space and share the join link.
atmos-config
Atmos root configuration: atmos.yaml discovery, precedence, deep merging, basepath, imports, minimal bootstrap, and routing to narrower Atmos skills.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
story-readiness
Validate that a story file is implementation-ready. Checks for embedded GDD requirements, ADR references, engine notes, clear acceptance criteria, and no open design questions. Produces READY / NEEDS WORK / BLOCKED verdict with specific gaps. Use when user says 'is this story ready', 'can I start on this story', 'is…
autotask-creator
Rules for automation CRUD from the group-chat commander. The commander does not call mutation tools and does not edit cloud/autotasks files directly. It emits one or more top-level ... containers in its final text; the bus parses and applies them after the turn.
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.