fable-harness: Skill for Claude Code

.claude/skills/cognitive-rubrics/SKILL.md

cognitive-rubrics is a skill for Claude Code from Miguok/fable-harness. It costs 185 tokens per session (2,780 once invoked), scanned A, original, MIT.

Decision rules for coding agents about when to slow down, ask the user, change approach, or perform a final challenge of their own solution. They focus on risky changes, repeated failures, secrets, and complex state or timing behavior.

In plain words
What is it for?
Use them before changing hooks, CI, deployment scripts, schedules, production settings, migrations, concurrency logic, or any change affecting several files.
Why use it?
They help catch unsafe assumptions before changes affect production, payments, credentials, deployments, or databases. They also prevent silently claiming success when verification has not passed.

Skill for Claude Code

Written for Claude Code: SessionStart hook event. Also seen: mentions CLAUDE.md.

This is Miguok/fable-harness's own configuration. It tells Claude Code how to work on fable-harness itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything fable-harness configures →

Reuse

Borrowing it

Nothing to install: this file belongs to Miguok/fable-harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Miguok/fable-harness/main/.claude/skills/cognitive-rubrics/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/Miguok/fable-harness

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cognitive-rubrics

README.md
[![agentmods](https://agentmods.dev/badge/skills/miguok/fable-harness/cognitive-rubrics/github.svg)](https://agentmods.dev/skills/miguok/fable-harness/cognitive-rubrics)
Your own site
<a href="https://agentmods.dev/skills/miguok/fable-harness/cognitive-rubrics"><img src="https://agentmods.dev/badge/skills/miguok/fable-harness/cognitive-rubrics/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for cognitive-rubrics

Your own site · 80×15
<a href="https://agentmods.dev/skills/miguok/fable-harness/cognitive-rubrics"><img src="https://agentmods.dev/badge/skills/miguok/fable-harness/cognitive-rubrics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 185 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,780 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00185 $0.02780
Opus 5 $0.00093 $0.01390
Sonnet 5 $0.00037 $0.00556
Haiku 4.5 $0.00018 $0.00278

Measured 9d ago against content hash cc70c84ecd8f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

cognitive-rubrics scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/cognitive-rubrics/SKILL.md · 105 lines

How it starts

The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Cognitive Rubrics

把「判斷力」轉成可執行的檢查表。每條都有觸發條件——命中就執行,不靠感覺。 與 FABLE-PROTOCOL(SessionStart 注入)的關係:協議定原則(OODA/抗辯/DoD),本檔給「何時觸發」的機械判準。

When to slow down

觸發任一即降速(先讀完既有的驗證與契約再動手;專案還沒有那些東西時,先寫下你打算怎麼驗):

  • 要動的是不需要人啟動就會跑的東西——判準是「它會不會在沒有人看著的時候執行」。例:hook、CI 配置、佈署腳本、排程、生產配置、交易策略、資料庫 migration。
  • 一個修改會波及 >3 個檔案。
  • 你正要寫「應該可以」「大概是」「理論上」——這是沒證據的訊號,先去拿證據。
  • 同一個錯誤第二次出現(第一次的修法沒修到根因)。(此為「降速」訊號;「換路」與「升級」見後兩節——三者計數的對象不同(錯誤復發/方法重試/猜測),別合併成同一條規則。)
  • 被 verify gate 擋回——只有兩條合法出路:補跑測試,或明確回報「已修改、未驗證」。禁止默默二次結束騙過 soft gate(gate 第二次會放行是防卡死設計,不是給你鑽的洞)。
  • 正例:改 verify_gate.py 前先讀 tests/test_verify_gate.py 十個案例,理解契約再動。
  • 反例:看到 regex 覺得「加個 \b 就好」直接改——上一個這樣做的模型製造了假放行漏洞。

When to ask the user

必問(hard-stop,不得自行繼續)

  • 找不到專案根目錄/備份失敗(備份失敗即停,不得無備份改檔)。
  • 要動生產、交易、金流、憑證、外部服務行為。
  • 發現機密(金鑰/token/帳密)——停手回報位置,不引用內容。
  • 用戶指令與系統/安全/工具限制衝突。
  • 多種合理解讀且選錯代價高(刪除、覆蓋、對外發布、佈署全域)。

不問(自己決定並明說假設):可回復的實作細節、命名、測試組織方式、暫存檔位置。

  • 正例:「佈署到全域」→ 停,等 使用者 明確點頭(專案守則 + 全域鐵則「重大改動先迭代到點頭」)。
  • 反例:「我可以開始了嗎?」——可回復、在原始需求範圍內的動作直接做,問了只會阻塞。

When to change path

  • 同一方法連續失敗 2 次 → 停止重試,換方法或升級——不是第 3 次重試。(此門檻管「自己重試同一方法」;子代理交出實質錯誤結果 1 次即升級,見 model-dispatch-rules skill,兩個數字管不同對象。)
  • 修 A 壞 B、修 B 壞 A 的蹺蹺板出現 → 退回起點,重新定位根因(你在治標)。
  • 實際結構與假設不符(檔案不存在、API 簽名不同、欄位缺失)→ 回 Observe 重蒐證,不硬編。
  • 正例:兩次修 regex 都被突變樣本繞過 → 改策略為「鎖整句 + 負向斷言」(本 kit 實史:C7 條款鎖,見 memory「子字串測試鎖可繞過」)。
  • 反例:驗證紅了 → 改斷言/放寬判準讓它綠。斷言是契約不是障礙。

When to escalate to a stronger model

  • 根因分析兩輪無果、架構取捨、安全判斷、抗辯裁決 → 用當前模型的最大推理力:主迴圈直接處理,或委派時不指定 model 讓子代理繼承(CLAUDE.md 分工表,動態不寫死)。(抗辯三反方除外,依協議 §5 floor 句。)
  • 特殊語法檔編譯錯誤:收集完整錯誤 trace 後升級(model-dispatch-rules skill 鐵則),嚴禁盲目重試。
  • 自檢訊號:你發現自己在「猜」而不是「推導」——猜第二次之前就升級。(此指升級到更強模型;同一方法重試的換路煞車=連續失敗 2 次,見 When to change path,兩個門檻管不同動作。)
  • 正例:PowerLanguage 編譯錯誤兩次修不好 → 附完整錯誤原文 + 已試方案,交回主迴圈(當前模型)分析。
  • 反例:「再試一版看看」連續五輪——token 燒完,檔案也被改花了。

<skill_hook_adversarial_debate>

定位:單模型的草稿自攻模組,命中觸發條件時於輸出前執行。與既有三子代理 skill 分兩層,不互相取代:

機制 時機
本模組(輕) 同一模型自己 Red Team 攻草稿 → Blue Team 修復 → 才交付 命中下方觸發條件時強制執行(「複雜產物」=命中觸發條件者,無第二判準)
adversarial-review skill(重) 平行派 skeptic / red-team / simplifier 三個獨立子代理 FABLE-PROTOCOL §2 觸發時機(重大結論採信前)

Read the full file on GitHub · 105 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 105 lines · 185 tokens per session scan A cc70c84ecd8f

Subscribe to this mod's changes

cognitive-rubrics is a skill published in the GitHub repository Miguok/fable-harness (202 stars, last pushed 2d ago), licensed MIT. It adds 185 tokens to every session and 2,780 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens

next-partial-prefetching-adoption

Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…

vercel/next.js · 103 tokens