Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/killernay/sandcastle-huahinnpx agentmods add skills/killernay/sandcastle-huahin/skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killernay/sandcastle-huahin/skill)<a href="https://agentmods.dev/skills/killernay/sandcastle-huahin/skill"><img src="https://agentmods.dev/badge/skills/killernay/sandcastle-huahin/skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killernay/sandcastle-huahin/skill"><img src="https://agentmods.dev/badge/skills/killernay/sandcastle-huahin/skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.02681 |
| Opus 5 | $0.00033 | $0.01340 |
| Sonnet 5 | $0.00013 | $0.00536 |
| Haiku 4.5 | $0.00007 | $0.00268 |
Grade A, and why
sandcastle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 202 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sandcastle
Two modes. Pick by what the repo already has.
.sandcastle/missing → SETUP.sandcastle/present → CHECK (default; also use after a run misbehaves)
Never guess a value. Every item below is a command whose output decides the answer. Report a table of PASS / WARN / FAIL with the fix next to each failure, then offer to apply the fixes — don't apply silently.
CHECK
Run these from the repo root. Each line is one check.
# 1. harness files
ls .sandcastle/{main.mts,plan-prompt.md,implement-prompt.md,review-prompt.md,merge-prompt.md,Dockerfile}
# 2. deps + script (FAIL → npm i -D @ai-hero/sandcastle tsx zod; npm pkg set scripts.sandcastle="tsx .sandcastle/main.mts")
ls -d node_modules/@ai-hero/sandcastle && npm pkg get scripts.sandcastle
# 3. real .env, not just the example (FAIL → cp .sandcastle/.env.example .sandcastle/.env and fill it)
test -f .sandcastle/.env && grep -c "^GH_TOKEN=." .sandcastle/.env
# 4. WORKSPACE_DIR points at a real workspace (empty value = repo root is the workspace)
W=$(grep -m1 "^WORKSPACE_DIR=" .sandcastle/.env | cut -d= -f2); ls "${W:-.}/package.json"
# 5. the false-green guard — see "Three slots" below
test -f .sandcastle/workspace-hint.md
# 6. optional planner knowledge
test -f .sandcastle/planning-rules.md
# 7. DEP_ORDER_FILE, if set, must exist
D=$(grep -m1 "^DEP_ORDER_FILE=" .sandcastle/.env | cut -d= -f2); [ -z "$D" ] || ls "$D"
# 8. issues exist — github: the label has open issues; local: issue files present
S=$(grep -m1 "^ISSUE_SOURCE=" .sandcastle/.env | cut -d= -f2); S=${S:-github}
if [ "$S" = "local" ]; then ls .sandcastle/issues/*.md; else
L=$(grep -m1 "^ISSUE_LABEL=" .sandcastle/.env | cut -d= -f2); L=${L:-ready-for-agent}
gh label list --search "$L" | head -3; gh issue list --state open --label "$L" --limit 5
fi
# 9. models live + sandbox image built + prompt args wired + no built-in overridden
npx tsx .sandcastle/check-models.mts
# 9b. the harness's own rules and its docs agree with its code (~200ms, no Docker)
npx tsx --test .sandcastle/*.test.mts
# 10. how many runs are live — TWO lines per run, 0 before you start another
ps -eo pid,lstart,command | grep "[.]sandcastle/main[.]mts"
# 11. containers: 2 per issue in flight is normal; only non-zero with NO run live is a leak
docker ps -a --filter name=sandcastle -q | wc -l
# 12. worktrees left dirty by a killed run — startup auto-rescues these (WIP commit on the issue branch, then clears); listed here so you know a kill happened
for w in .sandcastle/worktrees/*/; do [ -d "$w" ] && git -C "$w" status --porcelain | head -3; done
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 202 lines · 66 tokens per session scan A 4a416f73b1f8
sandcastle is a skill published in the GitHub repository killernay/sandcastle-huahin (5 stars, last pushed 1mo ago), licensed MIT. It adds 66 tokens to every session and 2,681 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…