Borrowing it
Nothing to install: this file belongs to jfarcand/mirroir-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jfarcand/mirroir-mcp/main/.claude/skills/carnet/SKILL.mdgit clone --depth 1 https://github.com/jfarcand/mirroir-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jfarcand/mirroir-mcp/carnet)<a href="https://agentmods.dev/skills/jfarcand/mirroir-mcp/carnet"><img src="https://agentmods.dev/badge/skills/jfarcand/mirroir-mcp/carnet/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jfarcand/mirroir-mcp/carnet"><img src="https://agentmods.dev/badge/skills/jfarcand/mirroir-mcp/carnet.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.02895 |
| Opus 5.5 | $0.00034 | $0.01158 |
| Sonnet 5.5 | $0.00017 | $0.00579 |
| Haiku 4.5 | $0.00008 | $0.00290 |
Grade A, and why
carnet scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Carnet
The register is shared by every repo of the product (registre.toml names it) and by many Claude Code sessions at once. Nothing on an issue says a session is on it, so peers collide: the same design was built twice ~35 minutes apart on 2026-08-31, and carnet#197 was found and written up independently by two sessions. A claim fixes that. It is three native GitHub facts that move together:
| Carrier | Meaning |
|---|---|
| assignee | the human accountable (gh login) |
label in-progress |
a live session holds the issue |
newest carnet-claim marker comment |
which session — id, name, user, host, pid, repo, branch, time |
One script does everything: .claude/skills/carnet/carnet.sh.
The incident history quoted in this skill (carnet#197, carnet#279, carnet#436, …) happened in
the dravr-* family, where it was built; those numbers are in dravr-ai/dravr-carnet.
Never run gh issue against the tracker by hand — the script is the one path that keeps the
three carriers consistent and the title shape uniform.
The rules
- Claim before the first edit — and it now happens without you. The PreToolUse hook
claims every issue the prompt named as soon as you touch a write tool, so an issue you
were told about is held before your first edit lands. Run
claim <n>yourself when the number never appeared in a prompt (you found the issue by searching, or you are picking up work mid-session). Not after the commit: a claim made after the work is done protects nobody. - A refusal is a peer, not an obstacle. Exit code 2 means another live session holds
the issue, or a session on another host does. Tell the user who and which session, and
stop. The auto-claim hook enforces this once: it blocks your first edit and names the
holder. It does not block again — after that you are accountable, not the hook. Do not
--stealon your own judgement — stealing is the user's call, and the stolen-from session is warned on the issue. - Release when you stop, close when it is fixed.
release <n>when you abandon or hand off;close <n> --why "…" --commit <sha>when the work landed. Both drop the label and the assignee and post a marker. A session that ends still holding claims is released by the SessionEnd hook, so a forgotten release is not fatal — but do not rely on it. - Every close says why.
--whyis mandatory and is what the next reader sees first. Add--commit <sha>whenever a commit resolved it:carnet#Nin a commit message is plain text to GitHub and never closes anything cross-repo. - File through
create. It reads the tracker fromregistre.toml, refuses a public tracker, prefixes the title[<project>], and always adds the project label. Titles are[<project>] <Thing>— one shape, no variants, capitalised first word unless it is an identifier. Thelimitationlabel goes only on an issue that aLIMITATION(registre#n)marker in source will point at; plain findings get the project label alone.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago First seen · 177 lines · 84 tokens per session scan A 6c8f89f5bbba
carnet is a skill published in the GitHub repository jfarcand/mirroir-mcp (265 stars, last pushed 2d ago), licensed Apache-2.0. It adds 84 tokens to every session and 2,895 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.
Other skills, from other repositories
daily-briefing
Start your day with a prioritized CRM briefing — works for any monday CRM setup: pipeline, contacts, accounts, leads, or no board at all. Use when someone says 'morning briefing', 'daily brief', 'what's on my plate today', 'catch me up on my deals', 'what needs attention', 'what needs my attention', 'anything urgent…
autopilot
Carry a well-scoped GitHub issue through the full dev loop autonomously, stopping at a per-run tier boundary (PR-ready, or merge+deploy for small reversible changes).
meeting-to-deal
Turn meeting transcripts into deal updates — key points, commitments, and next steps posted to matching CRM deals automatically. Auto-creates contacts for new attendees. Use when someone says "log my meetings to deals", "update CRM from calls", "what did I commit to in meetings", "sync notetaker", "log this meeting"…
task-workstream-grouping
Infer stable semantic workstreams for ungrouped Sutando task history and apply the validated assignments to the durable workstream sidecar. Use for internal task-workstream-grouping maintenance tasks, initial history backfills, and later batches of tasks that need cross-channel or cross-device workstream organization.
checkpoint
Quick 2-minute status update on current phase, completed work, blockers, and health check.
Technical Debt Tracking with PMAT
Tracks and manages technical debt using PMAT (Pragmatic AI Labs MCP Agent Toolkit). Use this skill when: User asks about technical debt, TODO comments, or code quality issues Planning sprint work and need to prioritize debt repayment Conducting code audits or technical debt assessments Tracking debt accumulation…