Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hani-q/qstack --skill qstack-liberogit clone --depth 1 https://github.com/hani-q/qstackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hani-q/qstack/qstack-libero)<a href="https://agentmods.dev/skills/hani-q/qstack/qstack-libero"><img src="https://agentmods.dev/badge/skills/hani-q/qstack/qstack-libero/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hani-q/qstack/qstack-libero"><img src="https://agentmods.dev/badge/skills/hani-q/qstack/qstack-libero.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.00597 |
| Opus 5.5 | $0.00039 | $0.00239 |
| Sonnet 5.5 | $0.00020 | $0.00119 |
| Haiku 4.5 | $0.00010 | $0.00060 |
Grade A, and why
qstack-libero scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Libero
The free defender behind the line. After the build, read what got through and clear it. Run this on finished work before calling it done.
Interrogate before you edit
- State the goal in one line, from the request or the plan, not from the code. If the goal cannot be stated, stop and ask; nothing below works without it.
- List what the work added or changed: each file, abstraction, flag, dependency, configuration, and test.
- For each item, name the assumption that justifies it and the evidence for that assumption. "Might be needed later", "seemed cleaner", and "the framework usually wants this" are not evidence.
- Sort the items: delete when the goal does not need it, simplify when a smaller form meets the goal, keep when it is needed as is. Optimize only what a measurement shows is too slow. Automate only what will run again.
- Report the sorted list, with the assumption and evidence beside each item, before changing anything.
Then change it, in that order
Delete first. Simplify what remains. Optimize only against a measurement. Automate last. Take a rung only when the one above it cannot meet the goal. Rerun the repository's relevant tests, linters, type checks, and builds after the edits. A deletion that breaks the goal is reverted, not patched around.
The floor
Never cut validation at a trust boundary, error handling that prevents data loss, security, accessibility, or a documented repository invariant, even when the goal as stated does not mention them. The repository's own instruction files name its invariants; read them before sorting. When an item looks unnecessary but sits on one of these, keep it and say why.
Scope and authority
Invocation authorizes edits to the work just built, within the user's scope. It never authorizes a commit, push, publication, deployment, or external message. Inside a QStack execution loop, the implementation ladder and the adversarial reviewer already cover this ground; use this skill on work outside a loop, or on a finished branch before opening a pull request.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 58 lines · 98 tokens per session scan A 081e0973b4ad
qstack-libero is a skill published in the GitHub repository hani-q/qstack (7 stars, last pushed 3d ago), licensed MIT. It adds 98 tokens to every session and 597 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
OpenSourceManagement
Triages open issues, pull requests and GitHub Discussions across the principal's own open-source repos (the list in Config.md) via the gh CLI, ranks what needs attention with suggested replies, posts edit-in-place marker comments, diffs new Ollama library models against a local model box, and takes a private repo…
Simplify
Research-first simplification of any file, skill, tool, subsystem or codebase against its ideal state: reads its ISA or derives its purpose, maps every dependent (callers, imports, references, hooks, settings, docs, tests), classifies each element with evidence as load-bearing, duplicate, dead, cruft or…
ratchet-files
Ratchet source file size so every file stays small enough for an agent to read whole: find every file over a token budget, split oversized files by concept, and set up the pre-commit ratchet that stops them from growing. Use when a commit is blocked because a file is over the size budget, when asked to find or split…
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.
output-eval-error-analysis
Systematically review workflow traces to identify failure modes before building evaluators. Use when starting an eval project, after significant pipeline changes, or when production quality drops.
pr-description-writer
Redacta una descripción de pull request clara y estructurada a partir de un diff de git, resumen de rama o lista de commits. Úsalo cuando te pidan escribir una descripción de PR, redactar una solicitud de cambios o documentar cambios de código. Produce una descripción con resumen, motivación, cambios realizados, pasos…