Borrowing it
Nothing to install: this file belongs to khaoss85/agent-crm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/khaoss85/agent-crm/main/.agents/skills/build-contract-activation/SKILL.mdgit clone --depth 1 https://github.com/khaoss85/agent-crmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khaoss85/agent-crm/build-contract-activation)<a href="https://agentmods.dev/skills/khaoss85/agent-crm/build-contract-activation"><img src="https://agentmods.dev/badge/skills/khaoss85/agent-crm/build-contract-activation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/khaoss85/agent-crm/build-contract-activation"><img src="https://agentmods.dev/badge/skills/khaoss85/agent-crm/build-contract-activation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00145 | $0.02657 |
| Opus 5 | $0.00072 | $0.01328 |
| Sonnet 5 | $0.00029 | $0.00531 |
| Haiku 4.5 | $0.00015 | $0.00266 |
Grade A, and why
build-contract-activation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orient yourself first
npm run crm -- app inspect --json
Read valid, then problems[], then limitations[], in that order. Every problem is fixed or reported before anything is built on top of it, and every limitation is a hard boundary on what you may claim. Then read packages[], capabilities[], resources[], actions[], policies[] and providers[]: that list is what exists. A capability absent from the report does not exist, whatever a record name, a label or a document suggests.
If the repository documents this skill names are absent, you are in a project built from this framework rather than in the framework itself. The inspection report is then the source of truth and those documents are optional background — do not guess at their contents, and do not assume a path exists because this skill names it.
Background, where they exist: ARCHITECTURE.md, DECISIONS.md (ADR-018 and its addenda), docs/CONTRACT_ACTIVATION.md and docs/PACKAGE_AUTHORING.md. They are the deeper source for the rules below, not a prerequisite for them — the rules stand on their own.
Build it as a domain package, not in core
- A new domain lives in
packages/<domain>/and is registered through the checked-inpackages/domains/generated/index.js— the same path a third-party package uses. The kernel must never import it, and removing that one static import must leave every other milestone working. Prove it: boot the same project without the package and assert the kernel is unchanged. - The declaration is plain data built with
definePackagefrom the public surfacepackages/core/index.js:{ packageContract: 1, name, version, label, resources[], requires[], capabilities[], actions[], policies[{kind, definition}], metadata() }.metadata()returns function-free JSON for/api/schema; never a handler, a credential or a path. Import nothing else underpackages/core—docs/PACKAGE_AUTHORING.mdandcrm package validateare the contract. - If the domain needs something the runtime does not have, that is a generic runtime capability with no domain word in it, recorded as an ADR-018 addendum — never a domain concept smuggled into
packages/core. M12 needed exactly three: the domain registry seam, a strictbooleaninput type and an injectable application clock. - Domain records are ordinary manifests (
writable: "managed"throughout → capabilitiesget/list) applied by the project, not written by hand.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 107 lines · 145 tokens per session scan A 2a2793d946e0
build-contract-activation is a skill published in the GitHub repository khaoss85/agent-crm (2 stars, last pushed today), licensed MIT. It adds 145 tokens to every session and 2,657 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
financial-audit-trail
Build immutable audit trails for all financial transactions with user attribution, change logging, tamper detection, and compliance-ready export for external audits.
html-ppt-zhangzara-stencil-tablet
A workplace-safety compliance review for a manufacturing regulator — findings, the evidence chain, and the corrective mandate. Built as a decision-grade policy briefing deck for regulator, plant leadership.
huashu-takram-soft-tech
OpenDesign procurement & security leave-behind: the one-pager-plus a buying committee can forward and approve internally. Built as a decision-grade B2B sales deck for buying committee, security, procurement.
einbeziehung-online-clickwrap-browsewrap
Für Einbeziehung Online Clickwrap Browsewrap: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.
kurzfristige-preiserhoehung-lieferfrist
Für Kurzfristige Preiserhöhung 309: prüft Frist, Form, Zuständigkeit und Eilbedarf; Ergebnis: Fristen- und Risikoampel. Fachgebiet: AGB-Recht-Prüfer. Route: kurzfristige-preiserhoehung-lieferfrist.
plattform-online-gate-rollout-rangfolge
Für Plattform und Online Checkout: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: plattform-online-gate-rollout-rangfolge.