Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JustineDevs/premortem --skill type-jugglinggit clone --depth 1 https://github.com/JustineDevs/premortemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/justinedevs/premortem/type-juggling)<a href="https://agentmods.dev/skills/justinedevs/premortem/type-juggling"><img src="https://agentmods.dev/badge/skills/justinedevs/premortem/type-juggling.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.03204 |
| Opus 5 | $0.00027 | $0.01602 |
| Sonnet 5 | $0.00011 | $0.00641 |
| Haiku 4.5 | $0.00005 | $0.00320 |
Grade A, and why
type-juggling scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to type-juggling — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SKILL: PHP Type Juggling — Weak Comparison & Magic Hash Bypass
AI LOAD INSTRUCTION: PHP
==coercion, magic hashes (0e…), HMAC/hash loose checks, NULL from bad types, and CTF-stylestrcmp/json_decode/intvaltricks. Use strict routing: map the sink (==vshash_equals), PHP major version, and whether both operands are attacker-controlled. Routing note: when you encounter PHP login/signature logic or code likemd5($_GET['x'])==md5($_GET['y']), start with this skill; ifhash_equals/===is already used, this path usually does not apply.
0. QUICK START
First-pass goal: prove the server branch treats unequal secrets/tokens as equal via coercion, not guess the real password.
First-pass payloads (auth / token shape)
password[]=x
password=
0
0e12345
240610708
QNKCDZO
true
[]
{"password":true}
admin%00
Minimal PHP probes (local or php -r in lab)
<?php
// Loose compare probes — run in target PHP major version if possible
var_dump('0e123' == '0e999');
var_dump('123a' == 123);
var_dump(md5('240610708') == md5('QNKCDZO'));
Routing hints
| Clue | Next step |
|---|---|
Source code uses == to compare passwords, tokens, or HMAC values |
Go to Sections 1-3 |
md5($a) == md5($b) or loose sha1 comparison |
Section 2 magic hashes |
hash_hmac(...) != '0' or compared with "0" |
Section 3 |
strcmp、json_decode(..., true)、intval |
Section 5 |
1. LOOSE COMPARISON (==) — TRUTH TABLE & VERSIONS
PHP compares operands with type juggling unless you use === or hash_equals() for secrets.
1.1 Core examples (strings vs numbers)
| Expression | Result | Mechanism (short) |
|---|---|---|
'0010e2' == '1e3' |
true | Both strings look numeric → compared as floats; both parse to 1000.0 (not zero — common exam trap; see next row for real “both zero”) |
'0e462097431906509019562988736854' == '0e830400451993494058024219903391' |
true | Both parse as 0.0 in scientific notation |
'123a' == 123 |
true | String cast to int stops at first non-digit → 123 |
'abc' == 0 |
true (PHP 7.x and earlier) | Non-numeric string compared to int → string becomes 0 |
'' == 0 |
true | Empty string → 0 |
'' == false |
true | both “falsy” in loose rules |
false == NULL |
true | loose equality |
0 == false |
true | loose equality |
'' == 0 == false == NULL |
true (chain) | Each adjacent pair is true under == (''==0, 0==false, false==NULL) — classic “falsy” chain |
'0' == false |
true | String '0' is the only non-empty string that compares as false to boolean |
'php' == 0 |
false (PHP 8+) | PHP 8: non-numeric string no longer equals 0 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 292 lines · 54 tokens per session scan A b8da531733cb
type-juggling is a skill published in the GitHub repository JustineDevs/premortem (2 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 54 tokens to every session and 3,204 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to type-juggling, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
laravel
Use when building or extending a Laravel 11/12 app — Eloquent models, migrations and relationships, routing with controllers and Form Requests, queues and background jobs, framework-native security (validation, mass-assignment, policies, signed URLs, rate limiting), and Pest/PHPUnit feature tests. NOT pure PHP…
yao-geoflow-template
Use only for explicit legacy GEOFlow template skill questions, old PHP template-package contracts, or historical outputs using root index.php/article.php/category.php/archive.php and includes/.php. Route current Laravel Blade themes, reference-site cloning, homepage modules, leadform, theme editor, channel frontend…
kirby-ide-support
Improves IDE autocomplete and static analysis in Kirby projects with PHPDoc hints and Kirby IDE helper generation. Use when types are missing or IDE support is degraded.
code-review-php
Deep PHP-specific code review covering strict types, PHPStan compliance, PSR standards, domain modeling, and ORM boundary violations. Applied in addition to the generic code-review skill when PHP code is detected. Invoked when reviewing PHP PRs, Symfony/Laravel changes, or performing PHP-specific quality checks.
developing-with-laravel
Laravel framework patterns for PHP applications including Eloquent ORM, migrations, routing, queues, and Blade templates. Use when building Laravel applications or working with Laravel projects.
developing-with-php
Modern PHP 8.x development with type system, attributes, enums, error handling, and Composer. Use when writing PHP code or working with PHP projects.