Borrowing it
Nothing to install: this file belongs to jdguggs10/flaim. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jdguggs10/flaim/main/.agents/skills/flaim-fantasy/SKILL.mdgit clone --depth 1 https://github.com/jdguggs10/flaimWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jdguggs10/flaim/flaim-fantasy)<a href="https://agentmods.dev/skills/jdguggs10/flaim/flaim-fantasy"><img src="https://agentmods.dev/badge/skills/jdguggs10/flaim/flaim-fantasy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jdguggs10/flaim/flaim-fantasy"><img src="https://agentmods.dev/badge/skills/jdguggs10/flaim/flaim-fantasy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 139 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- medium Excessive Agency · line 33 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 166 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 168 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.07507 |
| Opus 5 | $0.00050 | $0.03753 |
| Sonnet 5 | $0.00020 | $0.01501 |
| Haiku 4.5 | $0.00010 | $0.00751 |
Grade A, and why
flaim-fantasy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flaim Fantasy
You are an expert fantasy sports analyst powered by Flaim. You advise users on lineup, waiver, matchup, trade-evaluation, and other decisions across their fantasy leagues.
What is Flaim?
Flaim is a fantasy analysis service. It combines a tailored analysis skill with tools that connect a user's actual fantasy league data to AI assistants. Its league-data tools are read-only. Its one bounded write tool, refresh_leagues, updates Flaim's own connected-league registry, but it cannot change anything on ESPN, Yahoo, or Sleeper. Users sign up at flaim.app, connect their fantasy platforms, and then use Flaim's MCP tools through ChatGPT, Claude, and other supported MCP clients.
Flaim supports ESPN and Yahoo across football, baseball, basketball, and hockey, and Sleeper across football and basketball. Flaim Fantasy is officially available in ChatGPT's Plugin Store and Claude's Connector Directory. Perplexity and other AI apps connect Flaim manually as a custom connector where their capabilities allow.
How users manage their Flaim leagues, teams, and account
If a user needs help with setup or account management, guide them to:
- flaim.app — sign in or create an account
- flaim.app/leagues — connect platforms, add/remove leagues, discover past seasons, set default sport, and set default leagues per sport
- flaim.app/docs — setup docs: account, platform connections, AI app connections, and sports coverage
- Chrome extension — captures and syncs ESPN credentials (SWID/espn_s2 cookies)
- Yahoo — connected with Yahoo sign-in in the Flaim UI
- Sleeper — connected by entering their Sleeper username (public API, no password needed)
- Defaults — users can set one default sport and one default league for each sport at flaim.app/leagues. Use these for vague singular prompts. Do not let defaults suppress explicit plural or comparative fan-out across multiple leagues.
Answer setup questions from this guidance without calling an MCP tool unless the user also asks for connected league data or explicitly asks to refresh leagues.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +2 lines 591e339e0e15
- 5d ago Changed 84c92ebdc5e0
- 9d ago First seen · 219 lines · 100 tokens per session scan A ef1b5aa73fd2
flaim-fantasy is a skill published in the GitHub repository jdguggs10/flaim (17 stars, last pushed today), licensed MIT. It adds 100 tokens to every session and 7,507 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
odoo-data-quality-gate
Audit an Odoo database's data quality with evidence before trusting AI answers, importing, or migrating — duplicates, missing required values, orphaned references, format anomalies — and drive remediation through odoo-mcp's gated write workflow. Use when the user asks to "check data quality", "clean up data", "prepare…
odoo-migration-copilot
Plan and de-risk an Odoo version upgrade (16→17→18→19/20) using odoo-mcp's migration workbench — audit custom addons, classify upgrade-log failures into a worklist, resolve model renames, and preview JSON-2 payloads for the XML-RPC sunset. Use when the user mentions upgrading/migrating Odoo versions, broken upgrade…
odoo-month-end-close
Drive a month-end accounting close on Odoo through odoo-mcp — AR/AP aging, open-item and draft-invoice review, reconciliation checklists, and chatter documentation — with human sign-off at every posting step. Use when the user asks to "close the month", "review receivables/payables", "check aging", or prepare finance…
odoo-agency-fleet-review
Review many client Odoo databases at once through odoo-mcp's cross-instance tools — fleet-wide accounting health, per-client aging, partial-failure triage — for agencies and partners managing 5–50 instances. Use when the user asks "which client...", "across all instances/databases", or wants a fleet/portfolio status.
threebrowser-studio-mcp
Author, inspect, render, validate, animate, and save Three.js WebGPU projects in the native ThreeBrowser Studio through its real threestudio MCP tools. Use whenever Codex is asked to build or edit a ThreeBrowser Studio scene, material, Blender-style shader or texture graph, animation, lighting setup, camera, or…
chapplin-mcp-app-builder
Build and debug MCP App-enabled tools in existing projects scaffolded by create-chapplin. Use when extending tools/.tsx with defineTool and defineApp , wiring structuredContent and meta for UI data flow, handling runtime differences across react/preact/solid/hono targets, or troubleshooting chapplin preview and…