Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kucherenko/gangsta --skill launderinggit clone --depth 1 https://github.com/kucherenko/gangstaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kucherenko/gangsta/laundering)<a href="https://agentmods.dev/skills/kucherenko/gangsta/laundering"><img src="https://agentmods.dev/badge/skills/kucherenko/gangsta/laundering/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kucherenko/gangsta/laundering"><img src="https://agentmods.dev/badge/skills/kucherenko/gangsta/laundering.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 71 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.02760 |
| Opus 5 | $0.00017 | $0.01380 |
| Sonnet 5 | $0.00007 | $0.00552 |
| Haiku 4.5 | $0.00003 | $0.00276 |
Grade A, and why
laundering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 252 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Laundering: Verification and Integration
Overview
A successful Heist is only complete when the "loot" is refined into its final, legitimate form. Laundering handles integration, verification, cleanup, and institutional memory updates.
Trigger
Invoked after all Crew Leads report territory completion and the Don approves (The Hit complete).
Process
Step 1: Integration
Merge all territory branches/worktrees into the Heist branch:
# If using worktrees per territory
git merge territory/<name> --no-ff
Resolve any conflicts. If conflicts are non-trivial, escalate to the Underboss for a mini-Grilling.
Step 2: Verification
Run the full verification suite:
# Run all tests
<project test command>
# Run linter
<project lint command>
# Run type checker (if applicable)
<project type check command>
All checks must pass. If any fail:
- Identify which Work Package introduced the failure
- The responsible Crew Lead dispatches a Worker to fix it
- Re-run verification
Use gangsta:sweep-verification — every claim of passing must be backed by fresh command output.
Identifier Scan (Blocking Gate): Scan all project files outside docs/gangsta/ for Gangsta-internal spec identifiers using the pattern \b(FR|NFR|WP)-\d+\b (matches FR-001, NFR-042, WP-007, FR-1, etc.).
grep -rn --include="*.md" --include="*.ts" --include="*.js" --include="*.py" --include="*.go" --include="*.rb" --include="*.java" --include="*.txt" -E "\b(FR|NFR|WP)-[0-9]+" . --exclude-dir=docs/gangsta
- Any match is a blocking defect. Remove the identifier from the deliverable and re-run the scan before declaring the Heist clean.
- Exception: if a match is a legitimate project identifier unrelated to Gangsta planning, record the matching string, the file path, and a one-sentence justification in this laundering checkpoint. The Don MUST acknowledge the exception as part of the checkpoint review sign-off before this gate is cleared.
Step 3: Technical Debt Audit
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 252 lines · 35 tokens per session scan A 785e2d899b72
laundering is a skill published in the GitHub repository kucherenko/gangsta (81 stars, last pushed 25d ago), licensed MIT. It adds 35 tokens to every session and 2,760 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
workflow-patterns
Systematic task implementation using TDD, phase checkpoints, and structured commits. Ensures quality through red-green-refactor cycles, 80% coverage gates, and verification protocols before proceeding.
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
pod-init
Initialize CocoPlus project bundle in the current directory. Creates .cocoplus/ directory structure, copies all templates, initializes AGENTS.md, project.md, flow.json, and creates the initial git commit. Run this once per project before using any other CocoPlus command.
ship
Enter the Ship phase of CocoBrew. Reads review.md approval, generates structured commit, creates semantic version tag, optionally creates PR via gh CLI, and records deployment details. Requires approved review.
review
Enter the Review phase of CocoBrew. Aggregates findings from Code Quality Advisor, CocoCupper intelligence, spec compliance check, and decision coverage gate. Produces review.md with decision points. Requires developer approval before $ship can proceed.
lean-review
CocoLean diff-scoped over-engineering audit — scans uncommitted git diff and applies five classification tags (delete/stdlib/native/yagni/shrink) to identify unnecessary surface area before commit.