Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mataeil/ooda-loop/ooda-setupnpx skills add mataeil/OODA-loop --skill ooda-setupgit clone --depth 1 https://github.com/mataeil/OODA-loopWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00032 | $0.03746 |
| Opus 5 | $0.00016 | $0.01873 |
| Sonnet 5 | $0.00006 | $0.00749 |
| Haiku 4.5 | $0.00003 | $0.00375 |
Grade A, and why
ooda-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. **service_health**: If `config.health_endpoints` is non-empty, curl each endpoint How it starts
The opening of the file, as written. The whole thing — 320 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ooda-setup — Project Setup Wizard
Entry point for new users. Run /ooda-setup after cloning OODA-loop.
Runs a 3-step interactive wizard: scan → confirm domains → write config.json.
Safety Check (Always First)
Read agent/safety/HALT. If the file exists → print [HALT] Setup blocked. Remove agent/safety/HALT to continue. and stop immediately.
If config.json already exists → back up to config.json.bak and ask:
[WARNING] config.json already exists.
(o) Overwrite — discard current config, start fresh
(m) Merge — keep existing domains and safety settings, update detected values only
(a) Abort — cancel setup
Choice (o/m/a):
o→ overwrite entirely (backed up to config.json.bak)m→ read existing config, preserve user-modified fields (domains, safety, progressive_complexity.current_level, cost), only update auto-detected values (project.name, test_command, deploy_workflow, health_endpoints)aor anything else → abort
Step 1/3: Scan Project
Print: [1/3] Scanning your project...
Detect Monorepo — before language detection, check for monorepo indicators:
package.jsonhas"workspaces"field → npm/yarn workspaces monorepopnpm-workspace.yamlexists → pnpm monorepolerna.jsonexists → Lerna monorepopackages/orapps/directory exists with multiple sub-package.jsonfiles → probable monorepo
If monorepo detected, scan each workspace root for its own indicator files and aggregate results. Print:
Structure: monorepo ({N} packages detected)
If not a monorepo, print Structure: single-package.
For monorepos, auto-detect values from the root config first, then fall back to the first workspace that has the relevant indicator. Use the root package.json scripts for test/build commands unless a workspace-level override exists.
Detect Language — use Glob to check for indicator files:
| Indicator | Language |
|---|---|
package.json |
TypeScript (if *.ts files exist) or JavaScript |
go.mod |
Go |
Cargo.toml |
Rust |
pyproject.toml / requirements.txt |
Python |
Gemfile |
Ruby |
pom.xml / build.gradle |
Java |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 320 lines · 32 tokens per session scan A 80cd98df95a3
ooda-setup is a skill published in the GitHub repository mataeil/OODA-loop (5 stars, last pushed 2mo ago), licensed MIT. It adds 32 tokens to every session and 3,746 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
security-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for…
integrity-forensics
Run the Anti-Autoresearch integrity-forensics sweep (span-anchored evidence ledger → GPT auditors propose findings → a rules-only reporter that lists every proposal with what the auditor said about it) against a paper via a SHA-pinned thin launcher — then convert the verdict into a typed policy gate…
patent-novelty-check
Assess patent novelty and non-obviousness against prior art. Use when user says "专利查新", "patent novelty", "可专利性评估", "patentability check", or wants to evaluate if an invention is patentable.
flow-next-tracker-sync
Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.
flow-next-export-context
Export RepoPrompt context to a markdown file for review with an external LLM (ChatGPT, Claude web, etc.). Use when you want Carmack-level review but prefer an external model. Triggers on "export context", "export for external review", "export plan for ChatGPT", "export impl review context", "review with an external…
moai-ref-ui-polish
UI polish and interface-completion reference: the small visual details — concentric border radius, optical alignment, shadow-vs-border, motion easing, typography smoothing, tabular numbers, icon stroke weight, hit areas — that separate polished interfaces from generic ones. Agent-extending skill that amplifies…