ShadowFrog is a suite of coding-agent skills that maintains a file-backed knowledge base of tacit information about a codebase, such as fragile dependencies, untested invariants, and hard-to-notice edge cases. It helps coding agents preserve lessons from code reading, experiments, and conversations across future work. The catalogue contains skills that create, update, explore, organize, and view this shadow knowledge base.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/ShadowFrog --skill shadow-frog-dreamgit clone --depth 1 https://github.com/microsoft/ShadowFrogWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/shadowfrog/shadow-frog-dream)<a href="https://agentmods.dev/skills/microsoft/shadowfrog/shadow-frog-dream"><img src="https://agentmods.dev/badge/skills/microsoft/shadowfrog/shadow-frog-dream/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/microsoft/shadowfrog/shadow-frog-dream"><img src="https://agentmods.dev/badge/skills/microsoft/shadowfrog/shadow-frog-dream.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 12 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 40 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- high Privilege Escalation · line 202 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 203 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Tool Misuse · line 830 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 1126 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 1126 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 652 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Agent Snooping · line 139 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 309 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 507 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 809 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 917 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.12977 |
| Opus 5.5 | $0.00051 | $0.05191 |
| Sonnet 5.5 | $0.00026 | $0.02595 |
| Haiku 4.5 | $0.00013 | $0.01298 |
Grade B, and why
shadow-frog-dream scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
followed by `git worktree prune`, with a safety-gated `rm -rf` fallback if Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 1,243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ShadowFrog Dream
Autonomous experimentation while the user is away. Every task is an experiment — implement real code in a worktree, run it, persist as a named git branch pushed to a remote the user can write to. Dream's unique value is implementation experience that compounds across sessions.
Modes: Broad or Coherent
Accept mode=broad (default) or mode=coherent, for example
/shadow-frog-dream mode=coherent. Resolve the requested mode before planning.
Carry it into every task/subagent prompt, manifest, report, and validation
invocation. Use /shadow-frog-nap instead when the desired deliverable is a
lightweight feature-task brief rather than an executed experiment.
Broad mode keeps the category, coverage, and breadth rules below.
Coherent mode regularizes parent-child edges, not siblings or a whole tree.
Each child has its own goal and identifies a parent capability, finding,
limitation, or design decision motivating its work. It can extend, integrate,
challenge, replace, simplify, or offer an alternative. The shared
parent_connection format is defined in /shadow-frog.
- Ten children of one parent may pursue ten different worthwhile directions. Sibling summaries help avoid duplicates; they do not impose a common goal, file-disjointness requirement, or fixed diversity quota.
- Technical independence is not an automatic rejection. A justified alternative can be coherent even without calling the parent's modules. Shared keywords, a parent ID, or merely touching the same file are not enough.
- A challenge needs a reason or evidence; do not manufacture flaws to lengthen a chain. Preserve unchanged user requirements and name superseded decisions.
- There is no fixed tree-wide feature objective. Direction can evolve through substantive local transitions. Stop a path when no useful continuation exists.
- Descendants wait for their actual parent implementation. Siblings may run in parallel in separate worktrees, including on the same files. Refresh the selected parent branch/tip after each accepted step rather than relying on the session-start branch snapshot for newly created parents.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- _dream_namespace.py 2.3 KB runs code
- _worktree_paths.py 585 B runs code
- _worktree_safety.py 10 KB runs code
- dream-cleanup.sh 6.4 KB runs code
- dream-coverage.py 9.1 KB runs code
- dream-gc.sh 13 KB runs code
- dream-reconcile.py 88 KB runs code
- dream-setup.py 14 KB runs code
- dream-tools.py 9.8 KB runs code
- dream-validate.py 18 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed · +27 lines 84c49979554e
- 1mo ago Changed · -69 lines 6224955abd9e
- 1mo ago Changed · +77 lines · +22 tokens per session 3c2cba965be7
- 1mo ago First seen · 1,208 lines · 106 tokens per session scan B 2ba12893d226
shadow-frog-dream is a skill published in the GitHub repository microsoft/ShadowFrog (30 stars, last pushed 6d ago), licensed MIT. It adds 128 tokens to every session and 12,977 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…
cwv-optimizer
Diagnose and fix Core Web Vitals issues on AEM Edge Delivery Services pages. Goes deeper than generic CWV advice by understanding EDS-specific performance patterns including the 100KB LCP budget, E-L-D loading phases, block rendering behavior, and third-party script impact. Produces specific fixes for LCP, CLS, and…
incident-response-incident-response
Coordinate production incident triage, mitigation, investigation, recovery, and follow-up. Use when responding to outages or other incidents that require structured operational coordination.
ci-fixer
CI failures - read error, minimal fix, verify.