Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hashgraph-online/awesome-codex-plugins --skill karpathy-guidelinesgit clone --depth 1 https://github.com/hashgraph-online/awesome-codex-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hashgraph-online/awesome-codex-plugins/karpathy-guidelines)<a href="https://agentmods.dev/skills/hashgraph-online/awesome-codex-plugins/karpathy-guidelines"><img src="https://agentmods.dev/badge/skills/hashgraph-online/awesome-codex-plugins/karpathy-guidelines/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hashgraph-online/awesome-codex-plugins/karpathy-guidelines"><img src="https://agentmods.dev/badge/skills/hashgraph-online/awesome-codex-plugins/karpathy-guidelines.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.00871 |
| Opus 5 | $0.00039 | $0.00436 |
| Sonnet 5 | $0.00016 | $0.00174 |
| Haiku 4.5 | $0.00008 | $0.00087 |
Grade A, and why
karpathy-guidelines scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Karpathy Guidelines
基于 Colin4k1024/andrej-karpathy-skills 的方法论做本地化吸收，用来降低代理在真实代码库里常见的三类失误：替用户做错假设、把实现做重、顺手改到不该碰的地方。
这不是新的编码规范、TDD 或验收框架，而是一层更前置的行为护栏：
- 需要代码风格、命名、通用工程规范时，接 coding-standards
- 需要测试先行与 RED/GREEN/REFACTOR 时，接 tdd-workflow
- 需要在收尾前给出构建、测试、校验证据时，接 verification-loop
用途
- 把“先理解再动手”变成默认动作，而不是出错后的补救。
- 把“能跑就行”的实现收敛成最小可交付方案，减少过度抽象和未来感设计。
- 把改动边界钉住，避免为了解一个问题顺手重写一片上下文。
- 把含糊任务改写成可验证结果，方便后续接 TDD、验证循环和 handoff。
默认做法
- Think Before Coding：先写清当前理解、关键假设、歧义点和更简单备选，不在有歧义时静默选一种解释。
- Simplicity First：只做当前需求闭环所需的最小实现；不要为“以后可能用到”先铺抽象、配置层或扩展点。
- Surgical Changes：只改与当前请求直接相关的文件和代码；如果发现无关坏味道，只记录，不顺手清理。
- Goal-Driven Execution：把“做某件事”改写成“达到什么可验证结果”；优先使用测试、命令输出或明确检查项作为成功标准。
触发信号
- 用户目标清楚，但实现解释不止一种，容易靠猜测直接开写。
- 任务范围小，却很容易被做成一层新抽象、框架或配置系统。
- 仓库已有稳定模式，改动只应触及局部逻辑，不应连带整理周边代码。
- 需求里出现“修一下”“加一下”“支持一下”这类宽泛表述，需要先收敛成功条件。
- 开始编码前需要决定：先问清楚、先补测试、还是先做最小实现。
配套约束
- 这是一层前置行为约束，不替代具体实现 skill；进入编码后仍应接对应语言/框架 skill。
- 一旦决定实现新行为或修复缺陷，继续按 tdd-workflow 走测试先行。
- 完成实现后，仍需用 verification-loop 或等价命令给出 fresh evidence。
- 如果简单方案与用户指定路径冲突，要明确说出 tradeoff，而不是私自改方向。
- 看到 unrelated dead code、命名问题或旁路重构机会时，默认记录在 handoff / review，不在当前改动里顺手处理。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 47 lines · 78 tokens per session scan A c060a46cf8be
karpathy-guidelines is a skill published in the GitHub repository hashgraph-online/awesome-codex-plugins (956 stars, last pushed today), licensed Apache-2.0. It adds 78 tokens to every session and 871 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
search
Search 2500+ curated ChatGPT and LLM open-source repositories. Use when the user asks to find tools, libraries, or repos related to ChatGPT, LLMs, RAG, agents, langchain, NLP, AI development, or any open-source AI tooling.
sprr
Single PR reviewer for awesome-quant. Use when the user asks to review, validate, comment on, label, close, or merge one specific pull request that adds README.md entries. Triggers include "sprr", "review PR", "check PR", and "validate contribution".
bprr
Bulk PR reviewer for awesome-quant. Use when the user asks to review all open PRs, review unreviewed PRs, bulk review, or mentions "bprr". Reviews open PRs lacking the reviewed label and presents a summary before any merge/comment/label action.
drawio-reconstruction
Reconstructs reference images into high-fidelity, editable Draw.io files with rendered previews: native Draw.io elements carry text and structure, SVG covers simple icons that match the reference, and cropped or transparent PNGs preserve complex visuals. Use when the user wants a diagram image, research figure…
benchmark-paper-template
Structures Benchmark and Evaluation papers using the five-pillar framework (Research Gap, Construction Pipeline, Evaluation Framework, Empirical Findings, optional Companion Method). Returns a completeness audit, a six-part Introduction logic chain, a Section 2-7 skeleton, and a pre-submission checklist. Use when…
reverse-engineering-android-malware-with-jadx
Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests…