Borrowing it
Nothing to install: this file belongs to kpavlov/tachyon. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kpavlov/tachyon/main/.agents/skills/tachyon-development/SKILL.mdgit clone --depth 1 https://github.com/kpavlov/tachyonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kpavlov/tachyon/tachyon-development)<a href="https://agentmods.dev/skills/kpavlov/tachyon/tachyon-development"><img src="https://agentmods.dev/badge/skills/kpavlov/tachyon/tachyon-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kpavlov/tachyon/tachyon-development"><img src="https://agentmods.dev/badge/skills/kpavlov/tachyon/tachyon-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 70 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01813 |
| Opus 5.5 | $0.00016 | $0.00725 |
| Sonnet 5.5 | $0.00008 | $0.00363 |
| Haiku 4.5 | $0.00004 | $0.00181 |
Grade A, and why
tachyon-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prime directives
- ATDD: prefer E2E, unit only for edge cases E2E can't cover. Start e2e tests before prod code.
- No
toString()as a serialization shortcut for structured/wire-facing content (resource results, prompt results, content-block mapping, anything that ends up in a JSON response).toString()on a record/POJO produces its debug form (Foo[bar=1]), not JSON — it silently corrupts the payload instead of failing loudly. Route structured values through the configuredPayloadSerializer/codec, or through a proper domain-to-domain mapping (e.g. one content-block type to its counterpart), even for the "shouldn't normally happen" fallback branch. ReservetoString()for values it's actually correct for:Stringpassthrough, numeric/boolean scalars, and well-specified formats likeInstant#toString()(RFC-3339). - Prefer an
importover a fully-qualified name. Fall back to FQN only where two same-named types are genuinely both referenced in one file, and then prefer FQN-ing just the side that isn't this module's own domain type, importing the other, rather than FQN-ing both out of caution. final varover explicit types. Usefinalfor fields/vars where possible.- Kotlin API refactors follow the adapter shapes in
docs/architecture/guidance.md. - Java
ServerBuilderis the implementation source of truth. Kotlin adds only thin adaptation for suspend lambdas and Kotlin-specific types; never duplicate validation or registration logic. - Treat
../../../examples/weather-mcpandexamples/weather-mcp-kotlinas Rosetta Stone examples. Keep their MCP features, metadata, behavior, and coverage functionally identical when changing either one. - Keep Kotlin source files focused. At more than 300 lines, consider splitting by owned responsibility before adding code.
- A public API change (new/changed method, param, wire field, or behavior contract like TTL/null
semantics) is not done until its docs are done: update the relevant file under
docs/, this skill, and/ordocs/architecture/guidance.mdin the same change. Don't defer it to a follow-up.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 58cb8dc79afa
- 1mo ago First seen · 79 lines · 41 tokens per session scan A 67f4a649ebe8
tachyon-development is a skill published in the GitHub repository kpavlov/tachyon (30 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 41 tokens to every session and 1,813 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
java-affected-tests
Use before opening or updating an OpenMetadata PR that changes Java, a JSON schema, an index mapping, a SQL migration, seed data or a pom — PR CI no longer runs the Java integration tests (they run only in the merge queue) and the JavaUIIT/search-it suites run only nightly, so this selects the unit tests and…
dup-classes
Verify whether generated Java classes duplicate openai-java models by comparing fields/types (names may differ). Use when checking for duplicate model coverage.
java-unit-test
A code-generation guide for Java unit tests in Spring Boot projects. Unit tests check one small piece of code in isolation; Spring Boot is a Java framework for building web applications and services.
112-java-maven-plugins
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) …
JUnit 5 Testing
Production-grade Java unit and integration testing with JUnit 5 covering assertions, parameterized tests, lifecycle hooks, Mockito mocking, nested tests, and extensions.
serenity-bdd-skill
Generates Serenity BDD tests in Java with Screenplay pattern, rich reporting, and Cucumber integration. Use when user mentions "Serenity", "Screenplay", "@Steps", "Serenity BDD". Triggers on: "Serenity BDD", "Screenplay pattern", "@Steps", "Serenity report".