Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mehrad-dm/mastermind --skill levelupgit clone --depth 1 https://github.com/mehrad-dm/mastermindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mehrad-dm/mastermind/levelup)<a href="https://agentmods.dev/skills/mehrad-dm/mastermind/levelup"><img src="https://agentmods.dev/badge/skills/mehrad-dm/mastermind/levelup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mehrad-dm/mastermind/levelup"><img src="https://agentmods.dev/badge/skills/mehrad-dm/mastermind/levelup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 70 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.01166 |
| Opus 5.5 | $0.00029 | $0.00466 |
| Sonnet 5.5 | $0.00014 | $0.00233 |
| Haiku 4.5 | $0.00007 | $0.00117 |
Grade A, and why
levelup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MasterMind: Level Up
MasterMind improves by editing its own knowledge base (its weights are fixed). This skill is the
disciplined loop that does it. Read ~/.mastermind/engineering/active-field.md first to know the active
field and its pack path (engineering/fields/<field>/).
Pick exactly one mode
Take the mode from the argument; default to capture. Do one mode per run: they touch different files under different rules, and blending them is how a lesson lands in the wrong file.
| Mode | Trigger | Read |
|---|---|---|
capture (default) |
a correction, review finding, or bug worth remembering | below. It's the whole job |
refresh |
standards may have drifted from the live ecosystem | refresh.md before writing anything: it carries the upstream-only write allowlist |
bootstrap <field> |
a new domain or stack with no pack | bootstrap.md |
Adding or rewriting a skill or agent is not a mode. It's a separate discipline: read authoring.md.
Two memory layers: the episode, then the lesson
.mastermind/journal.md, what happened (episodic). Dated one-liners appended at each verdict: the decision, the reason, the outcome. Cheap, append-only, and the project's own file.fields/<field>/lessons.md, what to do next time (semantic). Distilled from the journal.
Keeping both is what lets MasterMind say "we tried that in March and it failed because X": a lesson alone states a rule but can no longer justify it, so it gets argued with or quietly dropped. The journal is the evidence behind the rule; distil it forward and let the old entries age out.
capture (default): harvest lessons from this session/recent work
- Read the
· wrong ·lines of.mastermind/journal.mdbefore anything else (mastermind wrong-log). A miss with its catcher named is the highest-signal lesson there is, it already states the rule that was missing. Then read the rest of the journal and scan recent work for durable generalizable lessons: user corrections ("no, do X"), realcode-reviewerfindings, bugs fixed, and choices that proved right. The journal is the higher-signal source. It is what actually happened, already dated and deduplicated. Skip one-off/project-specific noise; keep only what applies to future tasks. - For each: append a one-line rule + bracketed "why" to
~/.mastermind/engineering/fields/<field>/lessons.md. Deduplicate against existing lessons. - If a lesson is a general default (not just a gotcha), promote it into
stack-defaults.mdat the right section. That's where it will actually change behavior. - Keep it tight. A lesson that isn't load-bearing is noise; keep only what earns its place.
- A mechanical lesson becomes a check, not a sentence. When the mistake is detectable by a script, lint rule, hook or test, propose that check to the user alongside the lesson line. A rule that stays prose gets broken again; this repo's own history shows it every time.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +3 lines d5a938ec146e
- 1mo ago First seen · 73 lines · 72 tokens per session scan A eda21a5db710
levelup is a skill published in the GitHub repository mehrad-dm/mastermind (23 stars, last pushed 6d ago), licensed MIT. It adds 72 tokens to every session and 1,166 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hatch3r-learn
Captures learnings from completed development sessions into reusable knowledge files for future consultation. Invoke manually, from board-pickup after PR merge, or with a specific issue number for targeted reflection.
competitive-programming-expert
Use this skill when user needs to solve competitive programming problems. Applicable to LeetCode, Codeforces, AtCoder and similar platforms. Triggers include: algorithm problem, coding challenge, time complexity analysis, data structure implementation, TLE (Time Limit Exceeded), MLE (Memory Limit Exceeded).
learning-memory
Use when capturing or restoring a learner's persistent profile to personalize teaching across sessions.
your-skill-name
State the educational problem this skill solves and the intended outcome.
challenge-generator
Use when generating personalized practice challenges calibrated to the learner's weak areas, level, and project context.
misconception-detector
Use when diagnosing a repeated conceptual mistake and designing a targeted correction loop to replace the faulty mental model.