Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ivanhoinacki/team-exp-claude-config --skill validate-infragit clone --depth 1 https://github.com/ivanhoinacki/team-exp-claude-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ivanhoinacki/team-exp-claude-config/validate-infra)<a href="https://agentmods.dev/skills/ivanhoinacki/team-exp-claude-config/validate-infra"><img src="https://agentmods.dev/badge/skills/ivanhoinacki/team-exp-claude-config/validate-infra/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ivanhoinacki/team-exp-claude-config/validate-infra"><img src="https://agentmods.dev/badge/skills/ivanhoinacki/team-exp-claude-config/validate-infra.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.03193 |
| Opus 5 | $0.00030 | $0.01597 |
| Sonnet 5 | $0.00012 | $0.00639 |
| Haiku 4.5 | $0.00006 | $0.00319 |
Grade C, and why
validate-infra scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
- Extract all env var mappings How it starts
The opening of the file, as written. The whole thing — 357 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Phase 0: Vault RAG (MANDATORY, BEFORE any Read/Grep)
You MUST call query_vault(query, service_filter) BEFORE reading codebase files or external sources. This is enforced by hook. No exceptions.
Validate Infrastructure, Config Consistency Check
Working Directories
- Obsidian workspace (docs, plans, features):
__VAULT_ROOT__ - Codebase (all LE services):
__CODEBASE_ROOT__
Validate that environment variables, Pulumi config, application config, and schema validation are consistent across all layers.
Common Agent Mistakes
- Single-environment check: Checking only staging Pulumi config and missing that prod is different. ALWAYS check BOTH
Pulumi.staging.yamlandPulumi.prod.yaml. - Ignoring secretNames vs envVars: Putting a secret value in
envVars[]instead ofsecretNames[]. Any key containing SECRET/KEY/TOKEN/PASSWORD/PRIVATE/CREDENTIAL must be insecretNames[]. - Missing schema.ts: Verifying env vars exist in Pulumi and environment-variables.ts but forgetting to check if schema.ts validates them. A missing schema entry means silent undefined at runtime.
- Config layer skip: Checking Layer 1 (Pulumi) and Layer 2 (env-vars) but not Layer 3 (config/*.ts). The config layer is where env vars get organized and typed.
- False positive on non-prod fallbacks: Reporting
?? ''fallbacks in test/spec/dev configs as issues. These are intentional and required for strummer validation. - Not generating fix commands: Finding issues but not generating copy-paste ready fix commands. Every issue must have an actionable fix.
The 4-Layer Chain (all must be in sync)
Layer 1: Pulumi YAMLs -> Defines env var values per environment
Layer 2: environment-variables.ts -> Maps process.env.* to named variables
Layer 3: config/*.ts -> Organizes vars into config sections
Layer 4: schema.ts -> Validates config shape at startup
If ANY layer is missing an env var, the service fails:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 357 lines · 61 tokens per session scan C 2a2c948782c9
validate-infra is a skill published in the GitHub repository ivanhoinacki/team-exp-claude-config (2 stars, last pushed 1mo ago), licensed MIT. It adds 61 tokens to every session and 3,193 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cost-optimization
Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.
istio-traffic-management
Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.
terraform-module-library
Build reusable Terraform modules for AWS, Azure, GCP, and OCI infrastructure following infrastructure-as-code best practices. Use when creating infrastructure modules, standardizing cloud provisioning, or implementing reusable IaC components.
linkerd-patterns
Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
ultralytics-platform
This skill should be used when user asks to "upload my model to Ultralytics Platform", "push this run to the platform", "upload a dataset to platform", "download a dataset from platform", "search platform datasets", "start cloud training", "train on platform GPUs", "export a model on platform", "deploy a model…
dokploy-deploy
This skill should be used when user asks to "deploy with Dokploy", "use Dokploy Cloud", "manage self-hosted Dokploy", "deploy Docker Compose on Dokploy", "manage Dokploy databases", "configure Dokploy domains", or "look up Dokploy CLI commands".