Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mattwynne/yaks --skill workgit clone --depth 1 https://github.com/mattwynne/yaksWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mattwynne/yaks/work)<a href="https://agentmods.dev/skills/mattwynne/yaks/work"><img src="https://agentmods.dev/badge/skills/mattwynne/yaks/work/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mattwynne/yaks/work"><img src="https://agentmods.dev/badge/skills/mattwynne/yaks/work.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 234 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.02383 |
| Opus 5.5 | $0.00010 | $0.00953 |
| Sonnet 5.5 | $0.00005 | $0.00477 |
| Haiku 4.5 | $0.00003 | $0.00238 |
Grade A, and why
work scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/yx:work — Working on Yaks
Overview
You orchestrate; subagents implement. Each leaf yak gets its own worktree and branch. When the subagent finishes and verification passes, you merge back to main.
The golden rule: Neither you nor your subagents may modify main's working tree.
When invoked with arguments (e.g., /yx:work fix auth bug), use those to identify which yak to work on.
Always announce: "I'm using /yx:work to implement leaf yaks in isolated worktrees. I'll merge back to main once verification passes."
When to Use
Use when:
- User asks to "implement", "work on", or "pick up" yaks
- Ready leaf yaks exist (has context, no @needs-human tag, no children)
- User wants to start building after mapping or preparing
Don't use when:
- No leaf yaks exist yet (use
/yx:mapfirst) - Yaks lack context or clear definition of done (use
/yx:preparefirst) - User is just exploring or planning (not ready to implement)
What This Skill Owns vs What the Project Owns
This Skill Owns
- Yak lifecycle (identify ready leaves, mark wip/done, handle @needs-human tags)
- Worktree management (create, cleanup, ensure main is never modified)
- Orchestration (dispatch subagents, review output, determine independence for parallel work)
- Merging (verify, merge to main, clean up branches)
The Project Owns
- Implementation practices: TDD, code review, commit messages, etc. — defer to project conventions
- Verification: Before merging, run the project's verification (tests, linting, CI checks). Check CLAUDE.md for "done" criteria
- Code quality: The subagent decides how to implement, what tests to write, how to refactor
The key: This skill provides structure; the project provides standards. Always check CLAUDE.md or project docs for verification requirements.
THE MAIN BRANCH RULE
Neither you nor your subagents may modify main's working tree. Main is for merging finished branches only.
- Subagents work in their own worktrees
- You (orchestrating agent) never edit files on main
- If uncommitted changes exist on main, STOP and ask the user
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 284 lines · 25 tokens per session scan A b6a61a67d502
work is a skill published in the GitHub repository mattwynne/yaks (61 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 2,383 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-project-management
Comprehensive GitHub project management with swarm-coordinated issue tracking, project board automation, and sprint planning.
beads
Use when working in a repository that uses bd or Beads for durable project task tracking, issue dependencies, blocker management, multi-session handoff, or shared work memory. Trigger when the user asks to find ready work, claim or close tasks, create follow-up work, inspect blockers, recover project context, or…
pipeline-conductor
Operating procedure for the kirocrew-pipeline-conductor agent. Use when a pipeline conductor session is seeded, inspected or debugged. You MANAGE one issue/PR pipeline on one repo: two columns per item (session working? item solved?), send intent, never re-derive a red yourself.
github
Drive GitHub via the official gh CLI — repos, issues, pull requests, releases, gists, Actions runs, and raw REST through gh api. Use when the user asks to inspect or manage GitHub.
create-milestone
Create a GitHub milestone for an upcoming release. Suggests the next version based on the latest release, gathers all merged PRs and closed issues since that release, presents a draft with two tables (Issues and PRs) for user approval, then creates the milestone and assigns all approved items.
skill-upstream-pr
Improve an open-source GitHub skill and open a friendly suggestion PR upstream: fork, run skill-creator's retrofit, attach asm eval before/after metrics. Don't use for local-only skills, authoring from scratch, bulk repos, or registry publish.