Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HsuanYuLee/polaris --skill command-postgit clone --depth 1 https://github.com/HsuanYuLee/polarisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hsuanyulee/polaris/command-post)<a href="https://agentmods.dev/skills/hsuanyulee/polaris/command-post"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/command-post/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hsuanyulee/polaris/command-post"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/command-post.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00178 | $0.23081 |
| Opus 5.5 | $0.00071 | $0.09232 |
| Sonnet 5.5 | $0.00036 | $0.04616 |
| Haiku 4.5 | $0.00018 | $0.02308 |
Grade C, and why
command-post scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- POLARIS-PRIOR-DECISIONS: python3 .claude/skills/command-post/scripts/command-post.py --prior-decisions --> How it starts
The opening of the file, as written. The whole thing — 1,060 lines — stays where its author put it; the contents beside it link to each section on GitHub.
指揮官模式 — 圖、下令、交棒、往上請示
多個 session 同時活著的時候,沒有人知道全貌。忘記關掉的吃著整台機器;兩個對同一棵樹 動手害彼此重跑;發號施令的那一個不知道別人手上有什麼,於是重複開單。
這支 skill 做四件事:畫地圖、指揮(一對一派工,或指派幾個 session 互審)、 交棒、問人的時候問得清楚。
指揮官是一個角色,不是一個 session。 狀態全部住在檔案裡——session 登錄、每個 session 自己寫的宣告、單樹的輪次狀態、指揮官日誌。任何讀了那幾份檔的 session 都接得起來,所以換 一個不需要交接會議,只需要照〈四、交棒〉那一節走。
目錄名與腳本檔名仍然是 command-post。 它是識別字:POLARIS-ACTOR-IDENTITY 那一行
指著那條路徑,改名會讓每一張單的 holders[] 從下一次寫入起推不出是誰。名字給人讀,路徑
給機器讀,兩者不必是同一個字。
硬規則:壓縮之後也要成立的十條
compact 之後一支 skill 只留前 5,000 tokens,所以這十條放在最前面;reinject-after-compact.sh
在壓縮後把這一節原文重新注入。每一條只是指路,細節在指名的那一節。
- 送給任何 session 的訊息,只送
command-post.py的--order/--review/--say印出來的本文,一個字不改;手打的會被 hook 擋。→〈送訊息只送印出來的本文〉 - 收到指令,第一個動作是查地圖:有線在做就轉給它,沒有就先回報建議;唯讀查詢也派線。→〈指揮者自己的五條邊界〉三
- 會改程式碼或行為的事,入口是
driving-work-to-done;指揮官不跳過它直接令線開單或施工。→〈誰去做哪一件〉 - 別的 session 開的單不收進來轉手;開單的人直接送給要做的那一個。→〈指揮者自己的五條邊界〉二
- 實作線回「改好了」,自己讀整份交付物;轉給使用者前看每句事實標的是量到、讀到還是推的。→〈指揮者自己的五條邊界〉五
- 下「併」「壓 tag」「上線」之前,先列每個環境的驗證格;有一格驗不到就不下。→〈併與上線的指令〉
- 給使用者的回覆照既有的三段(結論、根據、待決),報告照那支 skill 寫好的骨架;不發明第二種格式。→〈形狀就是這個 workspace 既有的那一份〉
- 被指出的錯,同一則回覆帶四格,規矩收進它該住的那支 skill 的那一節,不寫進自己的筆記。→〈被指出錯誤的那一輪就收進 harness〉
- 每一輪重讀指揮台那一頁,不靠記憶推「誰在做什麼、使用者在等什麼」。→〈指揮台那一頁:每一輪重讀〉
- 壓縮之後,先把手上用過的 skill 逐支重新 invoke,再繼續。→〈壓縮之後:重新 invoke,不靠摘要〉
一、地圖
python3 .claude/skills/command-post/scripts/command-post.py
python3 .claude/skills/command-post/scripts/command-post.py --json
它不問任何人。 答案全部讀得出來——~/.claude/sessions/{pid}.json 是完整的登錄,
每一份帶著 name、pid、cwd、sessionId、messagingSocketPath。逐個問一輪要花掉每個
peer 一輪 context,而那一輪的答案還不一定比它自己剛寫下的話新。
「它在做什麼」是那個 session 自己寫下的宣告,不是它 transcript 裡最後一則說的話, 也不從名字、路徑或進程資訊推一句——推出來的那一句長得跟讀到的一模一樣,而它會在最需要 真話的時候是錯的。
每個 session 自己寫自己的那一行,只寫自己的:
python3 .claude/skills/command-post/scripts/command-post.py --declare \
--session-id <自己的 sessionId> \
--line '哪條線' --browser '有/沒有' \
--holding '接的是什麼' --blocked-on '現在卡在哪;沒卡就寫「沒有」' \
--tickets-opened '開了哪幾張單給誰' \
[--station '<站別>'] [--skills '<載著哪幾支 skill>']
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · -16 lines 1f2e2112f716
- 3d ago Changed · +31 lines cd4e074bb357
- 5d ago Changed · +149 lines 3e62ad76f388
- 6d ago Changed · +85 lines 5199a61de5c9
- 9d ago Changed · +20 lines f48c71bd280a
- 13d ago Changed · +21 lines 0f6c59db55b3
- 19d ago Changed · +64 lines 520f5bb8e79b
- 1mo ago Changed · +52 lines · +39 tokens per session 79280477a4b7
- 1mo ago Changed · +1 lines 76b461cf5853
- 1mo ago First seen · 653 lines · 139 tokens per session scan C 99e0a51945d9
command-post is a skill published in the GitHub repository HsuanYuLee/polaris (5 stars, last pushed 2d ago), licensed MIT. It adds 178 tokens to every session and 23,081 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prd-to-issues
A planning skill that turns an existing product requirements document, or PRD, into small GitHub Issues that developers can implement and verify. It groups work into complete user-facing slices instead of separate front-end, back-end, testing, and documentation tasks.
project-context-steward
A project-documentation skill that scans a new project or several related code repositories and records their shared context in a PROJECT_CONTEXT.md file. It captures the product, users, workflows, architecture, repository boundaries, terminology, entry points, and known pitfalls.
stylework-requirement-planning
A planning skill for reviewing a batch of product or business requests from sources such as Excel, CSV files, screenshots, or work-management exports. It groups requests by theme and records duplicates, dependencies, unclear items, and planning assumptions.
stylework-yunxiao-requirement-sync
A workflow for exporting selected requirements from Yunxiao, a project-management service, into a new sheet in an existing DingTalk online spreadsheet. It formats the result into a fixed set of columns and groups it by iteration.
strategic-alignment
Cascades strategy from boardroom to individual contributor. Detects and fixes misalignment between company goals and team execution. Covers strategy articulation, cascade mapping, orphan goal detection, silo identification, communication gap analysis, and realignment protocols. Use when teams are pulling in different…
process-mapper
Use when a BizOps lead, COO, or process-improvement owner needs to document an end-to-end business process (procurement, employee onboarding, incident handoff, customer-onboarding, claims adjudication) in BPMN-style notation, measure cycle times by stage, surface where work spends most of its time waiting vs. being…