Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/markshust/hcfnpx agentmods add skills/markshust/hcf/project-updateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/markshust/hcf/project-update)<a href="https://agentmods.dev/skills/markshust/hcf/project-update"><img src="https://agentmods.dev/badge/skills/markshust/hcf/project-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/markshust/hcf/project-update"><img src="https://agentmods.dev/badge/skills/markshust/hcf/project-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 67 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Excessive Agency · line 178 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.05382 |
| Opus 5.5 | $0.00013 | $0.02153 |
| Sonnet 5.5 | $0.00007 | $0.01076 |
| Haiku 4.5 | $0.00003 | $0.00538 |
Grade A, and why
project-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 270 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sync a project's HCF configuration with the latest plugin defaults. Non-destructive — adds missing files, generates what's needed, and flags differences in existing ones.
Prerequisites
This skill requires that /project-setup has been run at least once. If CLAUDE.md and .claude/ don't exist, tell the user to run /project-setup first and stop.
Execution Steps
Step 1: Verify Project Is Configured
Check that the project has been set up:
ls CLAUDE.md .claude/ 2>/dev/null
If either is missing, stop and tell the user:
This project hasn't been set up yet. Run
/project-setupfirst.
Step 2: Inventory Expected Files
These are the files that project-setup creates. Check which exist:
| File | Source |
|---|---|
CLAUDE.md |
Generated from project context |
.claude/testing.md |
Generated from project context |
.claude/code-standards.md |
Generated from project context |
.claude/architecture.md |
Generated from project context |
.claude/pipeline.mdis legacy and is no longer an expected ongoing file. HCF now enrolls agents via frontmatter (see HOOKS.md). If a.claude/pipeline.mdexists, it is handled by the one-time migration in Step 3 — do not treat its absence as a missing file.
Collect the list of missing files. Do NOT act on them yet — just note them.
Step 3: Migrate Legacy pipeline.md to Frontmatter
This is a one-time migration from the legacy central registry (.claude/pipeline.md) to per-agent frontmatter enrollment (the model described in HOOKS.md). This step detects what needs to happen here; the actual changes are applied in Step 6 after a single confirmation.
3a. Detect the legacy file
Check whether .claude/pipeline.md exists:
ls .claude/pipeline.md 2>/dev/null
- Absent → the project is already on the frontmatter model. Record migration status as "no legacy
pipeline.md— already on frontmatter" and skip the rest of Step 3 entirely. There is nothing to migrate. - Present → continue to 3b.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 270 lines · 33 tokens per session scan A 1185b730df7a
project-update is a skill published in the GitHub repository markshust/hcf (82 stars, last pushed 22d ago), licensed MIT. It adds 33 tokens to every session and 5,382 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agency-os
Notion-as-source-of-truth dispatch board. Status flow Suggestion→Discussion→To-Do→In Progress→Done with subtasks, recurring tasks, deps, batch agent execution. Trigger: 'suggest X', 'discuss X', 'approve', 'start X', 'run todo', 'mark X done', 'kill X', 'next', 'capture this to Notion', 'agency-os status'.
requirement-forge-refiner
Facilitate a structured conversation to define requirement standards for a project — epic and feature definitions, scenario structure, AC format, priority notation, status workflow, and naming conventions. Produces a formal requirement-standards.md that the requirement-quality atom reads via config resolution…
wayfinder
Chart a too-big effort as a shared map of decision tickets on the Gaia headquarters issue tracker, then resolve them one at a time until the way to the destination is clear. Use when someone says: "this is too big for one session", "chart a map", "wayfinder map", "plan this effort", "what do we need to decide first"…
gaia-triage
Triage the Gaia issue backlog and skill-batch intake queue. Use this skill when someone asks to: "triage issues", "clean up the issue tracker", "review the backlog", "close stale issues", "process the intake queue", "review skill-batches", "evaluate draft skill proposals", "approve or reject pending skills", "is this…
gaia-issue-resolver
End-to-end plan → implement → review pipeline that takes one triaged Gaia issue to a merged-ready PR, with Kill Criteria on the issue and zero follow-up debt. Use when someone says: "resolve this issue", "take #N end-to-end", "work the P0 queue", "fix and ship this issue", "run the resolver", "close out this issue…
beads-onboard
This skill should be used when the user asks to "onboard beads", "set up beads conventions", "configure beads for this project", "set up project labels", "improve my beads quality", "run beads onboard", "upgrade beads conventions", "re-run beads onboard", or when a project has .beads/ but no .beads/conventions/…