Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hiendinhngoc/unknowns/log-deviationnpx skills add hiendinhngoc/unknowns --skill log-deviationgit clone --depth 1 https://github.com/hiendinhngoc/unknownsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hiendinhngoc/unknowns/log-deviation)<a href="https://agentmods.dev/skills/hiendinhngoc/unknowns/log-deviation"><img src="https://agentmods.dev/badge/skills/hiendinhngoc/unknowns/log-deviation.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00567 |
| Opus 5 | $0.00024 | $0.00283 |
| Sonnet 5 | $0.00010 | $0.00113 |
| Haiku 4.5 | $0.00005 | $0.00057 |
Grade A, and why
log-deviation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deviation Log
The plan said one thing; the code demanded another. Record it while it's fresh — these entries are the highest-value input to the next plan.
Where the log lives
- In a git repo:
docs/deviations/YYYY-MM-DD-<task-slug>.mdat the repo root (createdocs/deviations/if needed).<task-slug>= short kebab-case name of the current task. Slugs are minted freely, so two sessions will name the same task differently: before creating a new file, list what already exists indocs/deviations/and reuse the slug of any file that is plausibly this task — appending to it even if it's from an earlier day/session — rather than minting a near-duplicate. - Outside a git repo: write to the session scratchpad instead and tell the user the path.
Entry format (append, newest last)
## <YYYY-MM-DD HH:MM> — <one-line summary>
- **Plan said:** <what the plan/spec assumed>
- **Code forced:** <what was actually done instead>
- **Why:** <the real-world constraint that made the plan wrong>
- **Ripple:** <other plan steps this invalidates, or "none">
The heading carries the full date: the file spans days by design, and HH:MM
alone goes ambiguous on the second session.
Discovered drift
Not every deviation is caught live. When work reveals that plans or docs already disagree with the shipped code (a stale roadmap item, a doc promising a design the code abandoned), log it with the same fields plus one more:
- **Found while:** <the current activity that surfaced it>
Date the heading with the discovery time; if the deviation's original date is known, name it in Code forced.
Rules
- One entry per deviation, logged at the moment it happens — not batched at the end.
- "Why" names the constraint (API limitation, hidden coupling, wrong assumption), never just "it didn't work".
- If invoked with no deviation to log, ask what deviated rather than inventing one.
- Do not commit the log automatically; leave staging to the user's normal flow.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 59 lines · 49 tokens per session scan A e7a4016726fa
log-deviation is a skill published in the GitHub repository hiendinhngoc/unknowns (9 stars, last pushed 1mo ago), licensed MIT. It adds 49 tokens to every session and 567 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fast-resume
Search local coding-agent session history and identify safe resume commands. Use when the user asks to find, inspect, continue, or recover previous work from Claude Code, Codex, Pi, or another agent indexed by fast-resume.
kanban-orchestrator
Kanban orchestrator: decompose, route, verify. No executing.
kunpeng-skill
跨智能体、本地优先的多源蒸馏与迁移工作流。用于收录或蒸馏代码仓库、网站、App、UI/交互、图片与品牌、视频、音频、文章、文档、书籍、课程及混合素材，形成带证据的可迁移画像、再生成规范、产品方案和本地方法库；也用于把画像应用到新主题或新 idea 并验收结果。.
exploit-xss
Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use this skill when user mentions XSS, cross-site scripting, script injection, or needs to test JavaScript injection in parameters, forms, headers, or DOM sources.
results-storage
SQLite-based persistent storage and reporting system for penetration testing results. Use this skill when user needs to store scan results, query vulnerabilities, generate reports, or manage pentest data across sessions.
npm-security-best-practices
Apply npm/pnpm supply-chain hardening when adding a dependency, editing package.json/.npmrc/pnpm-workspace.yaml, reviewing a lockfile change, or configuring CI install steps. Covers the 17 practices from lirantal/npm-security-best-practices.