Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add iliaal/whetstone --skill ia-c-systemsgit clone --depth 1 https://github.com/iliaal/whetstoneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iliaal/whetstone/ia-c-systems)<a href="https://agentmods.dev/skills/iliaal/whetstone/ia-c-systems"><img src="https://agentmods.dev/badge/skills/iliaal/whetstone/ia-c-systems/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iliaal/whetstone/ia-c-systems"><img src="https://agentmods.dev/badge/skills/iliaal/whetstone/ia-c-systems.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.00912 |
| Opus 5 | $0.00042 | $0.00456 |
| Sonnet 5 | $0.00017 | $0.00182 |
| Haiku 4.5 | $0.00008 | $0.00091 |
Grade A, and why
ia-c-systems scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `goto cleanup` / `goto err` | Kernel, OpenSSL, curl, php-src: the dominant multi-resource release idiom | How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
C Systems & Native Code
Covers C11 and later for libraries, systems code, and native extensions. For C++ (RAII, templates, move semantics), see the ia-cpp-systems skill.
Working rules
- Preserve the repository's sanctioned idioms and ABI; do not turn a scoped fix into a restyle.
- State ownership, check fallible calls, validate public boundaries, and assert internal invariants.
- Bound traversal of external input and check sizes before allocation or narrowing.
- Choose helpers only when they name a concept, own an error, or isolate a side effect.
- Verify the actual rebuilt artifact; use instrumented tests for safety and representative release builds for performance.
Repo conventions outrank this skill
Read the repo's AGENTS.md/CLAUDE.md, its public headers, and two adjacent .c files before writing anything. Where they conflict with the rules below, they win, and the diff carries no note about it.
This gate is load-bearing. Established C codebases sanction idioms these rules would otherwise flag:
| Local idiom | Where it is correct |
|---|---|
| Tab indentation | php-src and its extensions, Linux kernel |
goto cleanup / goto err |
Kernel, OpenSSL, curl, php-src: the dominant multi-resource release idiom |
Macros containing return |
RETURN_*/RETVAL_* in PHP extensions, Py_RETURN_* in CPython |
| Project status types | zend_result, CURLcode, int plus errno: do not invent a parallel enum beside one |
Never widen a scoped task into a repo-wide restyle because adjacent untouched C predates a rule here.
When the target is a PHP extension (php_*.h, PHP_FUNCTION, zend_, config.m4), load php-extension-c.md before applying any rule below. Layout, macros, the error model, memory, and assertions all carry extension-specific overrides, and the memory one in particular inverts the base guidance: extensions use a request-scoped allocator, not malloc/free.
Verify
- Build passes under the repo's warning profile with zero newly introduced warnings (greenfield: the full
-Wall -Wextra -Werror -Wconversion -Wshadowbundle, zero warnings) - Test suite passes under
-fsanitize=address,undefinedwith zero reports valgrind --leak-check=full --error-exitcode=1clean where the suite links under it- Every new fallible call site checked; every new error value traced to one producer
- Every new state-mutating leaf carries an assert
- No new
gotooutside the repo's sanctioned form or the single-forward-jump cleanup; no recursion over external input; no loop over external input without a named bound
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -136 lines e52c7c71de1a
- 2d ago First seen · 203 lines · 84 tokens per session scan A 1b936dc4293c
ia-c-systems is a skill published in the GitHub repository iliaal/whetstone (33 stars, last pushed 2d ago), licensed MIT. It adds 84 tokens to every session and 912 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
rubber-ducky
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke holes in this", "what am…
project-setup
Setup and hardening review for cross-platform modern-C++ (C++17) native projects, especially Node.js addons built with node-gyp / node-addon-api. Use when asked to "set up a native addon", "harden a C/C++ build", "review my binding.gyp", "add compiler hardening flags", "wire up AddressSanitizer/UBSan/TSan/clang-tidy"…
cpp-reinforcement-learning
C++ Reinforcement Learning best practices using libtorch (PyTorch C++ frontend) and modern C++17/20. Use when: Implementing RL algorithms in C++ for performance-critical applications Building production RL systems with libtorch Creating replay buffers and experience storage Optimizing RL training with GPU acceleration…
esp32-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting C++ firmware for ESP32 and variants (ESP32-S2, S3, C3, C6, H2, P4) using ESP-IDF or PlatformIO. Provides expert critique covering FreeRTOS task design, memory management (IRAM/DRAM/PSRAM), peripheral drivers (I2C/SPI/UART/GPIO)…
TypeScript Null Safety Guardrails
Enforce null/undefined safety for changed TypeScript code and suggest safer patterns.
TypeScript Strictness Guard
Enforce TypeScript strictness by reducing any/unsafe assertions and ensuring null handling.