Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/leonhoffmann86/team-sprint/bootstrapnpx skills add leonhoffmann86/team-sprint --skill bootstrapgit clone --depth 1 https://github.com/leonhoffmann86/team-sprintWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.03086 |
| Opus 5 | $0.00024 | $0.01543 |
| Sonnet 5 | $0.00010 | $0.00617 |
| Haiku 4.5 | $0.00005 | $0.00309 |
Grade D, and why
bootstrap scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
If `$ROOT/.claude/settings.json` is missing, create one with a small allowlist that lets the Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
"deny": ["Bash(git push *)", "Bash(git reset --hard *)", "Bash(git rebase *)", "Bash(rm -rf *)"] How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are installing the Sprint plan→implement→review workflow into the user's repo. This is a one-time, idempotent scaffold. Never overwrite an existing file silently.
0. Locate the plugin templates
The templates live at ${CLAUDE_PLUGIN_ROOT}/templates — i.e. the plugin as installed,
never a development checkout. Set:
TPL="${CLAUDE_PLUGIN_ROOT:-}/templates"
# Fallback when CLAUDE_PLUGIN_ROOT is unset (e.g. skill executed manually): resolve the
# INSTALLED plugin from the marketplace cache — most recently installed version wins.
[ -d "$TPL" ] || TPL="$(ls -dt "$HOME"/.claude/plugins/cache/*/sprint/*/templates 2>/dev/null | head -1)"
[ -d "${TPL:-}" ] || { echo "sprint is not installed. Run:
claude plugin marketplace add leonhoffmann86/team-sprint
claude plugin install sprint@team-sprint"; }
ROOT="$(git rev-parse --show-toplevel)" # must be a git repo; if not, offer: git init
If neither resolves, stop with that install instruction. Do NOT search the filesystem
for a plugin source tree and do NOT accept a git checkout of the plugin repo as $TPL —
only the installed (versioned) copy is a valid template source (see docs/DISTRIBUTION.md).
If $ROOT isn't a git repo, stop and offer to run git init first (the chain needs git hooks).
1. Detect the project type → propose config defaults
Inspect the repo root and pick sensible sprint.conf values:
| Marker file | Language | SPRINT_TEST_CMD |
SPRINT_VENV |
|---|---|---|---|
pyproject.toml / setup.py |
Python | .venv/bin/python -m pytest {path} -q (or python -m pytest {path} -q if no .venv) |
.venv (if it exists) else empty |
package.json |
Node | npm test (or pnpm test / yarn test per lockfile) |
empty |
go.mod |
Go | go test ./... |
empty |
Cargo.toml |
Rust | cargo test |
empty |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 184 lines · 0 tokens per session scan D 5c66a48effc8
bootstrap is a skill published in the GitHub repository leonhoffmann86/team-sprint (1 stars, last pushed 2mo ago), licensed MIT. It adds 48 tokens to every session and 3,086 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hive.colony-progress-tracker
Claim tasks, record step progress, and verify SOP gates in the colony SQLite queue. Applies when your spawn message includes a dbpath field.
discover-tasks
Use when user asks to "discover tasks", "find next task", "prioritize issues", "what should I work on", or "list open issues". Discovers and ranks tasks from GitHub, GitLab, local files, and custom sources.
wish
Convert an idea into a structured wish plan with scope, acceptance criteria, and execution groups for work.
seeds-issue-audit
Audit and triage open Seeds (sd) issues — find which can be closed, auto-close high-confidence completed ones, and report borderline cases. Activate for prompts like "audit open issues", "which seeds issues can be closed", "clean up the issue tracker", "triage the seeds backlog".
genie
Entry point for Genie operations — routes bug reports, questions, and operational commands, resumes existing lifecycle state, and orchestrates work that needs durable planning or coordination. Other ordinary requests bypass the lifecycle with a one-line notice unless the user asks for Genie.
report
Investigate bugs comprehensively — cascade through trace, capture browser evidence, extract observability data, and prepare or explicitly create a GitHub issue with grounded findings.