Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HigorAlves/orc --skill using-orcgit clone --depth 1 https://github.com/HigorAlves/orcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/higoralves/orc/using-orc)<a href="https://agentmods.dev/skills/higoralves/orc/using-orc"><img src="https://agentmods.dev/badge/skills/higoralves/orc/using-orc/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/higoralves/orc/using-orc"><img src="https://agentmods.dev/badge/skills/higoralves/orc/using-orc.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.01160 |
| Opus 5.5 | $0.00012 | $0.00464 |
| Sonnet 5.5 | $0.00006 | $0.00232 |
| Haiku 4.5 | $0.00003 | $0.00116 |
Grade A, and why
using-orc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Instruction priority
- User instructions (CLAUDE.md, direct requests) — always win.
- orc skills — override default system behavior where they conflict.
- Default system prompt — lowest.
Instructions say WHAT, not HOW: "Add X" / "Fix Y" never means skip the workflow.
Accessing skills
Use the Skill tool — never Read a skill file. Every skill's description is already loaded; invoke the one that fits.
Iron rules
- No commits to main/master/develop — branch first; check the branch before any commit. The PreToolUse hook downgrades protected-branch commits/pushes to a confirm prompt — approve it only with explicit user consent.
- No code without a failing test — write it, watch it fail, then implement. →
orc:tdd - No claim without verification — run it, read the output, then claim the result. →
orc:verification-before-completion - No fix without root cause — find why it's broken before changing code. →
orc:systematic-debugging - No AI attribution — never reference Claude/AI/automation, and never add
Co-Authored-Bytrailers, in code, commits, or PRs. The PreToolUse hook blocks it. - No multi-phase work without
.orc/state — register and checkpoint viaorc-stateafter every phase (schema + rules:orc:state-protocol), so/orc:resumesurvives interruption. - No silent broadcast in workspace mode — when the SessionStart banner says
workspace[…], repo-touching commands need an explicit--repos/--repo/--all-repos/--this-repoor a confirmingAskUserQuestion. →orc:workspace-mode - No PR over the size budget without a recorded choice — default 300 LOC (additions+deletions, post-exclusion); over budget → stack / open-big with a
Size-budget-override:trailer / abort. →orc:pr-size-budget. A web change → browser QA with.orc/<branch>/files/qa/artifacts, no exceptions. →orc:qa(drivesorc:agent-browser)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed 6626af047f00
- 1mo ago First seen · 53 lines · 31 tokens per session scan A 4f15b55d2b9b
using-orc is a skill published in the GitHub repository HigorAlves/orc (6 stars, last pushed 7d ago), licensed MIT. It adds 31 tokens to every session and 1,160 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
validate-release-green
Run or inspect the local Release-Green observer for an exact base or combined PR candidate, separating hard failures, advisory drift and incomplete evidence. Use for maintainer preflight; full CI acceptance remains a separate requirement.
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
tdd
Build this test-first, one behavior at a time: $ARGUMENTS.
create-prove
Run a changed Aeon skill for real and attach SHA-bound behavioral evidence to its PR.
blueprint-refactor-tranche
Take ONE target from the plan and land it without changing behaviour: guard it on the untouched code, move it verbatim, prove the equivalence by running both, mutation-sweep the tests, pass every gate, open a PR and merge it on green CI — or decline it with the cost written down.
blueprint-repo-baseline
Find the repository's own gates — install, format check, lint, typecheck, build, test — record them, and prove they all pass before anything is touched.