Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jlevy/simple-modern-uv --skill tbdgit clone --depth 1 https://github.com/jlevy/simple-modern-uvWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jlevy/simple-modern-uv/tbd)<a href="https://agentmods.dev/skills/jlevy/simple-modern-uv/tbd"><img src="https://agentmods.dev/badge/skills/jlevy/simple-modern-uv/tbd/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jlevy/simple-modern-uv/tbd"><img src="https://agentmods.dev/badge/skills/jlevy/simple-modern-uv/tbd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 9 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Rogue Agent · line 287 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00223 | $0.03808 |
| Opus 5.5 | $0.00089 | $0.01523 |
| Sonnet 5.5 | $0.00045 | $0.00762 |
| Haiku 4.5 | $0.00022 | $0.00381 |
Grade A, and why
tbd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 294 lines — stays where its author put it; the contents beside it link to each section on GitHub.
tbd helps humans and agents ship code with greater speed, quality, and discipline.
- Beads: Git-native issue tracking (tasks, bugs, features).
Never lose work across sessions.
Drop-in replacement for
bd. - Spec-Driven Workflows: Plan features → break into beads → implement systematically.
- Knowledge Injection: 25+ engineering guidelines (TypeScript, Python, TDD, testing, Convex, monorepos) available on demand.
- Shortcuts: Reusable instruction templates for common workflows (code review, commits, PRs, cleanup, handoffs).
Installation
npm install -g get-tbd@latest
tbd setup --auto --prefix=<name> # Fresh project (--prefix is REQUIRED: 2-8 alphabetic chars recommended. ALWAYS ASK THE USER FOR THE PREFIX; do not guess it)
tbd setup --auto # Existing tbd project (prefix already set)
tbd setup --from-beads # Migration from .beads/ if `bd` has been used
Routine Commands
tbd --help # Command reference
tbd status # Status
tbd doctor # If there are problems
tbd setup --auto # Run any time to refresh setup
tbd prime # Restore full context on tbd after compaction
CRITICAL: You Operate tbd — The User Doesn’t
You are the tbd operator: Users talk naturally; you translate their requests to tbd actions. DO NOT tell users to run tbd commands. That’s your job.
-
WRONG: “Run
tbd createto track this bug” -
RIGHT: (you run
tbd createyourself and tell the user it’s tracked)
Welcoming a user: When users ask “what is tbd?”
or want help → run tbd shortcut welcome-user
User Request → Agent Action
| User Says | You (the Agent) Run |
|---|---|
| Issues/Beads | |
| “There’s a bug where …” | tbd create "..." --type=bug |
| “Create a task/feature for …” | tbd create "..." --type=task or --type=feature |
| “Let’s work on issues/beads” | tbd ready |
| “Show me issue X” | tbd show <id> |
| “Close this issue” | tbd close <id> |
| “Search issues for X” | tbd search "X" |
| “Add label X to issue” | tbd label add <id> <label> |
| “What issues are stale?” | tbd stale |
| Planning & Specs | |
| “Plan a new feature” / “Create a spec” | tbd shortcut new-plan-spec |
| “Break spec into beads” | tbd shortcut plan-implementation-with-beads |
| “Implement these beads” | tbd shortcut implement-beads |
| Code Review & Commits | |
| “Review this code” / “Code review” | tbd shortcut review-code |
| “Review this PR” | tbd shortcut review-github-pr |
| “Commit this” / “Use the commit shortcut” | tbd shortcut code-review-and-commit |
| “Create a PR” / “File a PR” | tbd shortcut create-or-update-pr-simple |
| “Merge main into my branch” | tbd shortcut merge-upstream |
| Guidelines & Knowledge | |
| (any engineering work) | Load the General engineering group first (see below) |
| “Use TypeScript best practices” | tbd guidelines typescript-rules |
| “Use Python best practices” | tbd guidelines python-rules |
| “Build a TypeScript CLI” | tbd guidelines typescript-cli-tool-rules |
| “Improve monorepo setup” | tbd guidelines pnpm-monorepo-patterns or bun-monorepo-patterns |
| “Add golden/e2e testing” | tbd guidelines golden-testing-guidelines |
| “Use TDD” / “Test-driven development” | tbd guidelines general-tdd-guidelines |
| “Convex best practices” | tbd guidelines convex-rules |
| Documentation | |
| “Research this topic” | tbd shortcut new-research-brief |
| “Document architecture” | tbd shortcut new-architecture-doc |
| Cleanup & Maintenance | |
| “Clean up this code” / “Remove dead code” | tbd shortcut code-cleanup-all |
| “Fix repository problems” | tbd doctor --fix |
| Sessions & Handoffs | |
| “Hand off to another agent” | tbd shortcut agent-handoff |
| “Check out this library’s source” | tbd shortcut checkout-third-party-repo |
| (your choice whenever appropriate) | tbd list, tbd dep add, tbd close, tbd sync, etc. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 294 lines · 223 tokens per session scan A 8a9648c8dbb3
tbd is a skill published in the GitHub repository jlevy/simple-modern-uv (303 stars, last pushed 2mo ago), licensed MIT. It adds 223 tokens to every session and 3,808 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
antfu-issue-triage
Triage open issues and PRs of the current GitHub repo - find already-fixed, duplicate, and spam items, suggest labels, gauge demand from reactions and comments, then present a table of proposed actions and comments for confirmation before touching anything. Use when asked to triage, organize, clean up, or groom issues…
mcore-split-pr
Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.
engineer-bot-ops
A workflow for carrying an engineering task from scope through implementation and reviewable delivery. It works with a repository's branch, existing changes, rules, checks, and permissions while separating completed, unverified, and next-step work.
shiplog
Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a ready-to-post shiplog in your voice.
connect
Choose which wiki this session uses, the team project's pages on the Nimbalyst server or the project's local wiki of files, and connect a repository to its team project. Use at the start of a task before any wiki tool, when a wiki tool returns reponotbound, ambiguousproject, pinmismatch, projectnotaccessible…
llxprt-issue-workflow
Use this skill when asked to address, fix, or work on a GitHub issue in the llxprt-code repository. Covers the complete issue lifecycle - branch setup, gh CLI usage, test-first planning, subagent delegation and review loops, the full verification cycle (including the zai-glm-flash smoke test), open code review (ocr)…