Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HezaoHezao/poirot --skill skill-authoringgit clone --depth 1 https://github.com/HezaoHezao/poirotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hezaohezao/poirot/skill-authoring)<a href="https://agentmods.dev/skills/hezaohezao/poirot/skill-authoring"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/skill-authoring/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hezaohezao/poirot/skill-authoring"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/skill-authoring.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.02310 |
| Opus 5.5 | $0.00007 | $0.00924 |
| Sonnet 5.5 | $0.00003 | $0.00462 |
| Haiku 4.5 | $0.00002 | $0.00231 |
Grade A, and why
skill-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 253 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Authoring Poirot Skills
Overview
A SKILL.md can live in two places:
- Builtin (in-repo):
poirot/backend/agents/skill/builtin_skills/<category>/<name>/SKILL.md— committed, shipped with the package. Usewrite_file+git add. - User-local:
skills/<name>/SKILL.md— personal, gitignored. Created via/skill install <path>or by writing directly.
This skill covers authoring for both, with emphasis on builtin skills.
When to Use
- User asks you to add a skill "in this repo / commit"
- You're committing a reusable workflow that should ship with Poirot
- You're editing an existing skill under
builtin_skills/
Required Frontmatter
Source of truth: poirot/backend/agents/skill/parser.py::parse_skill_file.
Hard requirements:
- Starts with
---as the first bytes (no leading blank line). - Closes with
\n---\nbefore the body. - Parses as a YAML mapping.
namefield present (lowercase, hyphens).descriptionfield present.
Peer-matched shape:
---
name: my-skill-name # lowercase, hyphens
description: Use when <trigger>. <one-line behavior>.
allowed-tools: # Poirot tools this skill may invoke
- bash
- read_file
- write_file
- list_dir
- str_replace
- web_search
- browse_page
- present_files
- read_snapshot
enabled: true
related-skills: [other-skill] # optional cross-references
license: MIT # recommended for contributed skills
author: <human contributor or source attribution>
---
allowed-tools / enabled / related-skills / license / author are NOT
enforced by the parser (it reads name/description/allowed-tools/enabled), but
every peer has them — omit and your skill sticks out.
Description Standard
description ≤ 60 characters, one sentence, ends with a period. State the
capability, not the implementation. No marketing words ("powerful",
"comprehensive", "seamless"). Don't repeat the skill name.
Verify:
import re, pathlib
m = re.search(r'^description: (.*)$',
pathlib.Path('builtin_skills/<cat>/<name>/SKILL.md').read_text(),
re.MULTILINE)
assert len(m.group(1)) <= 60, len(m.group(1))
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 253 lines · 17 tokens per session scan A 9978210122c8
skill-authoring is a skill published in the GitHub repository HezaoHezao/poirot (258 stars, last pushed 3mo ago), licensed MIT. It adds 17 tokens to every session and 2,310 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bmad-correct-course
Assess the impact of a significant change during sprint execution across the PRD, epics, architecture, and UX documents, and produce a sprint change proposal. Use when the user says "correct course" or "propose sprint change".
bmad-spec
Condense any input — an idea, brief, PRD, transcript, or mixed notes — into a short spec: one kernel file plus supporting files that downstream skills build from. Also updates and validates existing specs. Use when the user says "create a spec", "distill this into a spec", "validate this spec", or "update the spec".
bmad-product-brief
Create, update, or validate a product brief. Use when the user wants help producing, editing, or validating a brief.
bmad-deep-recon
Research a topic to support a decision, three ways: draft a research prompt for the user to run in their own tool (ChatGPT, Gemini, Grok, Perplexity, …), turn a finished research report into a short summary with cited sources that other skills can use directly, or run the research here with parallel web searches.…
bmad-ticket
Create and manage tickets — initiatives, epics, stories, bugs. Use when the user says "create a new initiative", "slice this initiative", "split this epic up", "break this into stories", "incept this epic", "make a ticket", "refine this ticket", "what's ready", "status of a story", "publish ticket changes", "validate…
bmad-eval
Runs the evals of a BMad skill through the agent harness the user works in and reports what they show: baseline against the bare model, variant against a stripped or prior version, quality against a rubric, and trigger accuracy of the description with an optional optimization loop. Use when the user asks to evaluate…