Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joshukraine/dotfiles --skill bootstrap-prdgit clone --depth 1 https://github.com/joshukraine/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joshukraine/dotfiles/bootstrap-prd)<a href="https://agentmods.dev/skills/joshukraine/dotfiles/bootstrap-prd"><img src="https://agentmods.dev/badge/skills/joshukraine/dotfiles/bootstrap-prd/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joshukraine/dotfiles/bootstrap-prd"><img src="https://agentmods.dev/badge/skills/joshukraine/dotfiles/bootstrap-prd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 51 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Rogue Agent · line 80 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.01886 |
| Opus 5.5 | $0.00010 | $0.00754 |
| Sonnet 5.5 | $0.00005 | $0.00377 |
| Haiku 4.5 | $0.00003 | $0.00189 |
Grade A, and why
bootstrap-prd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bootstrap PRD
Set up PRD-driven development infrastructure for a new project. This skill handles two workflows: PRD-first (PRD files already exist, scaffold the project around them) and scaffold-first (no PRD yet, create template files to be filled in). The skill detects which situation applies and adapts.
Your task
Work through the steps below in order. Each step has a hard stop — do not proceed past a CHECKPOINT without explicit user approval.
Step 1: Detect existing PRD files
Check whether docs/prd/ exists and contains any .md files.
If PRD files exist → enter PRD-first mode:
- Read all
.mdfiles indocs/prd/to understand the project - Extract: project name, description, tech stack, personas, and any quick-start commands mentioned
- Skip to Step 3 (no need to gather information the PRD already contains)
If no PRD files exist → enter scaffold-first mode:
- Proceed to Step 2 to gather project information
Step 2: Gather project information (scaffold-first mode only)
Ask the user for the following. Skip anything already provided in the conversation context.
- Project name (e.g., "Acme Dashboard")
- One-paragraph description of what the project does and who it serves
- Tech stack — framework, database, frontend approach, linter, test framework
- Key personas — 1-3 user types with a sentence each
- Quick-start commands — how to start the app, run tests, run the linter
If the user provides a framework name, pre-fill quick-start commands from this lookup table (the user can override):
| Framework | Start | Test | Lint |
|---|---|---|---|
| Rails | bin/dev |
bin/rails test |
bin/standardrb --fix |
| Next.js | npm run dev |
npm test |
npm run lint |
| Hugo | hugo server -D |
(none) | (none) |
| Static (no build) | Open index.html or use a local server |
(none) | (none) |
| Generic | <!-- TODO: start command --> |
<!-- TODO: test command --> |
<!-- TODO: lint command --> |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 173 lines · 25 tokens per session scan A a652a970d148
bootstrap-prd is a skill published in the GitHub repository joshukraine/dotfiles (429 stars, last pushed 4d ago), licensed MIT. It adds 25 tokens to every session and 1,886 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
morning-coffee
Prepare a source-read-only daily engineering brief with GitHub pull requests, today's Google Calendar agenda, current-quarter Transport planning links, incident.io on-call and incident context, RFCs needing review, ranked daily priorities, and previous-working-day activity. Use for morning check-ins, daily planning…
factory-mcp
Use the Warp Factory MCP to hand work to a software factory and collaborate with it — bundle local work and send it to the cloud, find factory tasks from a Slack thread / Linear ticket / description, and pull a task down to test or iterate locally and hand it back.
oz-notify-user
Send a progress notification to the user who triggered this Oz task (e.g., via Slack or Linear).
oz-finish-task
Report task completion or failure back to the Oz platform when done with a task.
mbo-plan
Plan a new objective end-to-end in this repo's docs/mbo Management-By-Objective system — turn a GitHub issue or a gss draft-PR worktree into consistent design/spec/plan artifacts and track it in docs/mbo/index.md. Use this whenever the user wants to START planning or designing a new feature, skill, CLI, or service…
show-issues-overview
Show a table-formatted overview of the current repository's issues, from GitHub Issues, GitLab Issues, or a TODO.md-like file when the project has neither. Use when the user asks what issues/tasks are open, wants to decide what to work on next, or invokes /show-issues-overview.