Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mehrad-dm/mastermind --skill deprecategit clone --depth 1 https://github.com/mehrad-dm/mastermindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mehrad-dm/mastermind/deprecate)<a href="https://agentmods.dev/skills/mehrad-dm/mastermind/deprecate"><img src="https://agentmods.dev/badge/skills/mehrad-dm/mastermind/deprecate.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 26 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.01339 |
| Opus 5 | $0.00048 | $0.00669 |
| Sonnet 5 | $0.00019 | $0.00268 |
| Haiku 4.5 | $0.00010 | $0.00134 |
Grade A, and why
deprecate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MasterMind: Deprecate
Every other skill adds or fixes. This one deletes, migrates and retires: the half of engineering where the reward (a smaller system) arrives long after the risk, and where what breaks is whatever you couldn't see was still reading it.
The shape: expand → migrate → contract
Any removal that can't land in one atomic commit takes three phases, in this order, each shipped on its own:
- Expand: add the new thing beside the old. Both work. Nothing has moved yet, and stopping here breaks nothing.
- Migrate: move consumers in batches sized by blast radius: one caller at a time where a mistake pages someone, a whole service where it doesn't. Verify each batch before starting the next.
- Contract: remove the old, once nothing reads it.
Renaming users.email_addr to users.email on a live system, as five deploys:
1 add `email` · backfill · write both · still read `email_addr` ← expand, fully reversible
2 read `email` · keep writing both ← the only behavior change; watch it
3 move every caller off `email_addr`, batch by service ← migrate
4 stop writing `email_addr` · leave the column for one rollback window
5 drop the column ← contract
Each line deploys and reverts on its own; the sequence is the safety. Collapse any two and you get the classic outage: during a rolling deploy both versions run at once, so the instance that hasn't restarted yet is still writing to the column you just dropped.
Prove it's unused: never assert it
Never contract on a search you didn't run, and never treat one symbol search as the answer. "Nothing references it" is a claim about the whole system, and the places that break are the ones a symbol search can't see: config and environment, infra and CI, docs, runbooks and dashboards, other repos and clients you don't build, and every dynamic reference: a name assembled from a string, reflection, a container registration, a route table, a serialized payload, a stored default, an analytics event name. Search for the spelling, everywhere it could be written, not the identifier inside one tree.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 98 lines · 0 tokens per session scan A 086094e08754
deprecate is a skill published in the GitHub repository mehrad-dm/mastermind (24 stars, last pushed 8d ago), licensed MIT. It adds 97 tokens to every session and 1,339 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Backend Master Agent
Backend implementation playbook — API endpoints, database models/migrations, auth, query optimization, and the framework-specific traps that break servers in production. Use when implementing or reviewing server-side code: FastAPI / Django / Flask / Express / NestJS / Go / Axum handlers, SQLAlchemy / Prisma / Mongoose…
supabase
Database, auth, and backend expertise for Supabase operations in [PROJECTNAME].
backend-patterns
Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.
backend-patterns
Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.
event-sourcing-architect
Event sourcing and CQRS architecture principles. Event stores, projections, snapshots, and eventual consistency. Use when building audit-heavy or temporal systems.
supabase-firebase
Backend-as-a-Service patterns. Supabase and Firebase for auth, database, storage, and real-time. Use when building apps with BaaS platforms.