Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Harmeet10000/skills --skill skill-optimizergit clone --depth 1 https://github.com/Harmeet10000/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/harmeet10000/skills/skill-optimizer)<a href="https://agentmods.dev/skills/harmeet10000/skills/skill-optimizer"><img src="https://agentmods.dev/badge/skills/harmeet10000/skills/skill-optimizer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/harmeet10000/skills/skill-optimizer"><img src="https://agentmods.dev/badge/skills/harmeet10000/skills/skill-optimizer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.00507 |
| Opus 5.5 | $0.00033 | $0.00203 |
| Sonnet 5.5 | $0.00017 | $0.00101 |
| Haiku 4.5 | $0.00008 | $0.00051 |
Grade A, and why
skill-optimizer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to skill-optimizer — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
When to use
Use this skill when you need to:
- Improve whether a skill is actually applied by models
- Diagnose why some criteria fail across all models
- Prevent a skill from making outputs worse
- Refactor skill text for stronger retrieval under context pressure
- Build repeatable benchmark loops and release gates
Optimization loop (default workflow)
- Measure baseline and skill-on behavior (per model, per scenario, per criterion)
- Find failure pattern:
- universal failure (0% with skill)
- model-specific weakness
- regression (negative delta)
- Edit for salience:
- add explicit triggers
- add concrete integrated examples
- tighten checklists and decision rules
- Re-run evals and compare deltas
- Ship with guardrails (documented gate + run history + follow-up issues)
How to use
Read individual rule files for detailed procedures and templates:
- rules/benchmark-loop.md - End-to-end benchmark loop and scoring
- rules/activation-design.md - Improve retrieval and instruction uptake
- rules/context-budget.md - Reduce token cost without losing behavior
- rules/regression-triage.md - Diagnose and fix skill-on regressions
- rules/release-gates.md - Go/no-go criteria before shipping skill updates
Practical heuristics
- Prefer few high-signal rules over many soft recommendations
- Put fragile, high-value behaviors in top-level checklists
- Include at least one integrated example per common scenario
- Add explicit wording for what must not be omitted
- Track gains/losses with with-skill vs without-skill comparisons
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 48 lines · 83 tokens per session scan A 019de9dea8f6
skill-optimizer is a skill published in the GitHub repository Harmeet10000/skills (7 stars, last pushed 5mo ago), licensed MIT. It adds 83 tokens to every session and 507 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to skill-optimizer, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
verifier-overview
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
test-driven-development
A development method that writes tests before writing the feature or bug fix. TDD, or test-driven development, uses tests to define expected behavior first.
ti-yara-hunting
YARA rule writing from behavioral observations and TI report analysis — sample-to-rule conversion, condition optimization, performance tuning, and retrohunting on VirusTotal and ANY.RUN. Covers YARA/YARA-X syntax, yarGen automated generation, and production rule deployment.
m365-mailbox-compromise
Microsoft 365 mailbox compromise chain — OAuth consent phishing, delegate access abuse, mail rule persistence, and token theft via device code phishing. Full kill chain from initial access to persistent email collection.
blind-sqli
Blind SQL injection under hostile WAF — manual bypass playbook for when sqlmap fails because common tokens (SUBSTRING, IF, AND, WHERE, single quotes) are filtered. Covers token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search. Loaded on…
race-condition
Race condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint…