Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mehrad-dm/mastermind --skill initgit clone --depth 1 https://github.com/mehrad-dm/mastermindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mehrad-dm/mastermind/init)<a href="https://agentmods.dev/skills/mehrad-dm/mastermind/init"><img src="https://agentmods.dev/badge/skills/mehrad-dm/mastermind/init/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mehrad-dm/mastermind/init"><img src="https://agentmods.dev/badge/skills/mehrad-dm/mastermind/init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 117 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 117 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02029 |
| Opus 5.5 | $0.00022 | $0.00812 |
| Sonnet 5.5 | $0.00011 | $0.00406 |
| Haiku 4.5 | $0.00006 | $0.00203 |
Grade A, and why
init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Initialize: get MasterMind ready for this project, fast
The goal: a new user goes from "installed" to "the brain is set up for my stack and knows what I'm building" in a few quick steps: a handoff, not an intake form. Detect what you can; ask the rest. Run once per project; if this project already built its field, you're set: skip this.
Nothing ships pre-baked. A fresh install carries only the engine and engineering/fields/_template/
no field, because a pack tuned to someone else's stack is worse than none (dead weight that misleads).
So init's core job is to build this project's field from the template, tuned to the real stack. This
is where the measured quality lift comes from; without it you still apply solid general judgment, but the
domain pack is the difference.
Keep it short (the #1 rule)
Detect before asking: read the answers out of the project, and make the technical calls yourself. A developed project needs zero questions: continue with its own stack. A greenfield project needs one open question ("what do you want to build?"), answered in their own words. The whole thing should feel like 20 seconds, then you're working.
Path A: the project already has code
- Detect the stack:
package.json/lockfile, configs, framework + versions, DB, test runner, folder shape (core/agent-loop.md). This is free, read it rather than asking. - Set up its field:
- This project already built a field that fits → load it. Done. (Nothing else ships, so this only happens on a re-run of a project that was set up before.)
- Otherwise: build one from
engineering/fields/_template/, tuned to the detected stack: a one-time bootstrap (levelup bootstrap), stated as a trade-off, not a menu: "a few minutes now makes me much sharper on your stack: its real defaults, pitfalls, and review rules. It's once per field, then reused for every task." Build it to fit one real stack, and keep it lean, tailoring prunes as much as it adds (active-field.md). Fill the pack's "Where things are" section from what step 1 already detected: the half-dozen entry-point pointers (components, routes, state, tests + run command, config, the one file that explains the architecture fastest). This is the narrow exception to "skip the directory listing" below: a full tree is re-derivable noise, but these few pointers are what stop every future task from re-running discovery. Then pointactive-field.mdat it and regenerate the router from the brain you are installed into:node .mastermind/scripts/build-router.mjsfor a per-project brain, the default. Under--sharedthe brain is the one in your home directory, so run that same script from there. A barescripts/…path is the project's own directory and fails with MODULE_NOT_FOUND.
- Fill the project brief (
.mastermind/brief.md). An isolated install seeds it; under--sharedthere is no project brain, so create the file yourself at that path. The field pack holds the stack; the brief holds this project: what it is, the words it uses for its own ideas, what breaks and who feels it, what cannot be undone here, and how it ships. Most of it comes from step 1. Ask the user only for what the code cannot tell you, which is usually who feels an outage and which actions are irreversible. Keep it under about 40 lines: it is read every session. This is what stops a change that is technically correct and operationally wrong. - Respect the project: match its conventions and keep the stack it already chose
(
stack-defaults.md: the project wins).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed 9b7ae796fc50
- 1mo ago First seen · 130 lines · 55 tokens per session scan A 6377e168bb12
init is a skill published in the GitHub repository mehrad-dm/mastermind (23 stars, last pushed 6d ago), licensed MIT. It adds 55 tokens to every session and 2,029 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
st-full-workflow
Use when the user asks to run the complete end-to-end Strikethroo workflow for a work order in one shot in this repository — triggers include full workflow, end-to-end, plan and execute, do everything, run the whole strikethroo workflow. Do not use when the user wants only one stage (create a plan, generate tasks, or…
code-sec-review
Static security review that hunts exploitable vulnerabilities, prioritizing unauthenticated and cross-tenant attack paths.
agent-decision
Deterministic self-evaluation rubric for decision escalations — scored every run using the FRAME framework.
code-quality-review
Reviews code and plans against the project's coding rules.
review-loop
Two-mode review loop — single reviewer per epic, three reviewers for full branch.
setup-new-acpx-key
Configure the API key (or other credential) for a registered ACPX agentid (claude/codex/cursor/gemini/qwen/copilot/pi/droid/iflow/kilocode/kimi/kiro/opencode/tlamatini) end-to-end across data.keys, config.json (top-level + acpx.agents. .env), regensecrets.py, and verification via acpdoctor.