Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mgiovani/cc-arsenal/docs-rfcnpx skills add mgiovani/cc-arsenal --skill docs-rfcgit clone --depth 1 https://github.com/mgiovani/cc-arsenalWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mgiovani/cc-arsenal/docs-rfc)<a href="https://agentmods.dev/skills/mgiovani/cc-arsenal/docs-rfc"><img src="https://agentmods.dev/badge/skills/mgiovani/cc-arsenal/docs-rfc.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.01081 |
| Opus 5 | $0.00047 | $0.00541 |
| Sonnet 5 | $0.00019 | $0.00216 |
| Haiku 4.5 | $0.00009 | $0.00108 |
Grade A, and why
docs-rfc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create Request For Comments
Create a new RFC document proposing and discussing a change.
Anti-Hallucination Guidelines
RFCs propose changes to real systems, so ground every claim before writing:
- Verify current state: explore the codebase to understand what exists today
- Reference actual code: don't invent APIs or patterns; find real examples
- Check dependencies: confirm libraries/tools mentioned actually exist in the project
- Validate assumptions: each claim about current state must be verified
Workflow
Phase 1: Explore and Gather Context
Understand the codebase before writing anything. If the Task tool is available, use the Explore agent:
Use Task tool with Explore agent:
- prompt: "Analyze the codebase to understand [RFC_TOPIC]. Find: 1) Current implementation patterns, 2) Related components and their interactions, 3) Existing similar features, 4) Technical constraints. Return verified findings with file paths."
- subagent_type: "Explore"
No Task tool available: explore directly with grep/glob/read before writing,
covering the same four questions (current patterns, related components, existing
similar features, technical constraints). Either way, keep what you find: it feeds
the Background and Detailed Design sections in Phase 6.
Phase 2: Parse Arguments
- Extract proposal title from
$ARGUMENTS - Check for a variant keyword:
minimal,standard, ordetailed - If a variant is found, remove it from the title
- Default variant:
standard
Phase 3: Determine RFC Number
- Scan
docs/rfc/for existing files matchingRFC-XXXX-* - Increment the highest number by 1 (start at
0001if none exist) - Format as a 4-digit padded number (e.g.
0001,0023)
Phase 4: Sanitize Title for Filename
Convert the title to kebab-case, lowercase, special characters stripped.
Example: "Add GraphQL API Support" -> add-graphql-api-support
Phase 5: Get Author Information
Run git config user.name, falling back to "Development Team" if empty.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 116 lines · 94 tokens per session scan A 7f365f7e5b29
docs-rfc is a skill published in the GitHub repository mgiovani/cc-arsenal (7 stars, last pushed 6d ago), licensed MIT. It adds 94 tokens to every session and 1,081 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gitlab
Agent-callable GitLab tools — manage issues and merge requests, review diffs, commit files, run pipelines, and search. Use when the user mentions GitLab or wants to review or merge an MR, commit code, run CI, or manage issues — even if they don't name GitLab explicitly.
alpaca
Agent-callable Alpaca trading tools — place and manage stock, crypto, and options orders, read account balances, positions, and portfolio history, look up assets and market hours, and read watchlists. Use when the user mentions Alpaca or wants to trade or inspect a brokerage account, even if they don't name Alpaca…
dataforseo
Agent-callable DataForSEO tools — Google SERP results, keyword and domain analytics, backlinks, Google Maps business data, on-page audits, and AI-search visibility (LLM answers + brand mentions). Use when the user wants SEO or AI-search data, even if they don't name DataForSEO.
discord
Agent-callable Discord tools — send and manage messages, start threads and forum posts, manage channels, members, and roles, and post via webhooks. Use when the user mentions Discord or wants to post, read, or manage Discord servers, channels, or members, even if they don't name Discord explicitly.
dropbox
Agent-callable Dropbox tools — upload, organize, find, and share files and folders. Use when the user wants to manage Dropbox content (save, move, search, share, list, or read files), including requests that don't name Dropbox explicitly, e.g. "save this report to my cloud storage" or "share that folder with Sam".
google-analytics
Agent-callable Google Analytics 4 (GA4) tools — run analytics reports, discover the dimensions and metrics a property supports, navigate accounts and properties, manage key events and custom dimensions/metrics, and send Measurement Protocol events. Use when the user mentions Google Analytics or GA4, or wants…