Borrowing it
Nothing to install: this file belongs to hoophq/hoop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hoophq/hoop/main/.claude/skills/shape/SKILL.mdgit clone --depth 1 https://github.com/hoophq/hoopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hoophq/hoop/shape)<a href="https://agentmods.dev/skills/hoophq/hoop/shape"><img src="https://agentmods.dev/badge/skills/hoophq/hoop/shape/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hoophq/hoop/shape"><img src="https://agentmods.dev/badge/skills/hoophq/hoop/shape.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01028 |
| Opus 5.5 | $0.00019 | $0.00411 |
| Sonnet 5.5 | $0.00009 | $0.00206 |
| Haiku 4.5 | $0.00005 | $0.00103 |
Grade A, and why
shape scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Shape work into tickets
Input: a dictated idea, a rough note, or a Linear project ID. Output: tickets in Linear that an agent can run without asking anything.
Write every Linear field in English, whatever the conversation language.
1. Understand
Restate the goal in two lines and say who it is for. If a Linear project was given, read it and its existing issues first, so you extend rather than duplicate.
2. Investigate the code
Do this before cutting anything. Use subagents in parallel for breadth. Answer:
- Which modules:
gateway/,agent/,client/,common/,tunnel/,sidecar/,agentrs/,webapp_v2/. The legacywebapp/is frozen. - Does it touch the gateway↔agent contract (
common/proto/transport.proto, packet types, spec keys, payload formats)? That decidesmajor. - Does it touch the sidecar config the control plane serves?
- Migration needed? Read
gateway/migrations/for the next free number. - New env var? The helm chart and
.env.samplechange in the same PR. - New or superseded analytics event?
- Does it need an ADR in
hoophq/adr? Only for a structural change that spans modules, is expensive to reverse, changes the wire contract, or picks between real alternatives.
3. Cut vertically
Each ticket must be one complete flow, thin, testable end to end on its own.
GOOD PR1: the whole flow for one connection type, behind a flag
PR2: widen it to the rest
BAD PR1: migration PR2: model PR3: API PR4: UI
A horizontal cut leaves nothing testable until the last ticket. If a slice cannot stand alone, put it behind a feature flag rather than splitting it by layer.
4. Size by risk, not by lines
Risk = how much existing behaviour the change touches, times how hard it is to reverse.
- Its own small ticket: auth,
transport.protoand packet types, migrations, middleware order, anything a released agent reads. - May be large: new isolated code behind a flag, or a mechanical refactor
with tests. 3000 lines of new package is safer than 50 lines in
AuthMiddleware.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 123 lines · 47 tokens per session scan A 24ef1ff1db4c
shape is a skill published in the GitHub repository hoophq/hoop (837 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 1,028 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other skills, from other repositories
stale-sweep
Sweep the googleapis/mcp-toolbox repo for issues and PRs with no real activity in N days (default 60), sort each by whose silence it is (the author's, ours, or nobody's), and draft the nudge or close comment. Use whenever a maintainer asks for a stale sweep, backlog cleanup, or an SLO check, e.g. "stale sweep", "find…
linear-tickets
Create or update high-quality Linear tickets while preserving the originating report, diagnostic links, attachments, and reporter/requester attribution. Read this whenever someone asks to create, recreate, or update a Linear issue.
imaging-data-commons
Query and download public cancer imaging data from NCI Imaging Data Commons using idc-index. Use for accessing large-scale radiology (CT, MR, PET) and pathology datasets for AI training or research. No authentication required. Query by metadata, visualize in browser, check licenses.
geo-database
Access NCBI GEO for gene expression/genomics data. Search/download microarray and RNA-seq datasets (GSE, GSM, GPL), retrieve SOFT/Matrix files, for transcriptomics and expression analysis.
brenda-database
Access BRENDA enzyme database via SOAP API. Retrieve kinetic parameters (Km, kcat), reaction equations, organism data, and substrate-specific enzyme information for biochemical research and metabolic pathway analysis.
clinpgx-database
Access ClinPGx pharmacogenomics data (successor to PharmGKB). Query gene-drug interactions, CPIC guidelines, allele functions, for precision medicine and genotype-guided dosing decisions.