Borrowing it
Nothing to install: this file belongs to mmnto-ai/totem. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mmnto-ai/totem/main/.claude/skills/preflight/SKILL.mdgit clone --depth 1 https://github.com/mmnto-ai/totemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mmnto-ai/totem/preflight)<a href="https://agentmods.dev/skills/mmnto-ai/totem/preflight"><img src="https://agentmods.dev/badge/skills/mmnto-ai/totem/preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mmnto-ai/totem/preflight"><img src="https://agentmods.dev/badge/skills/mmnto-ai/totem/preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 65 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01765 |
| Opus 5.5 | $0.00010 | $0.00706 |
| Sonnet 5.5 | $0.00005 | $0.00353 |
| Haiku 4.5 | $0.00003 | $0.00177 |
Grade A, and why
preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Before starting work on issue $ARGUMENTS, execute these phases in order. Do NOT write code until all gates are cleared.
Phase 1 — Mechanical context gathering
- Run
pnpm exec totem spec $ARGUMENTSto generate the implementation spec from the issue body. Output lands in.totem/specs/<issue>.md. - Call
mcp__totem-dev__search_knowledgewith a query describing the changes you're about to make. If the issue touches a specific system (hooks, orchestrator, compiler, extract pipeline, store layer, MCP server), ALSO querymcp__totem-strategy__search_knowledgefor relevant ADRs and proposals. - Summarize in 3-5 bullets: what the spec says, which lessons are relevant, and any constraints or traps surfaced by the knowledge queries.
If totem spec fails, report the error and stop — do not proceed to Phase 2.
Phase 2 — Scope triage (decide if Phase 3 is needed)
Skip Phase 3 if this is a tactical change. Tactical means ALL of:
- Pure bug fix, wording change, or existing-test tightening
- No new types or required fields on existing types
- No new state containers (maps, sets, module-level variables, singletons)
- No new failure modes or classes of error
- No new cross-cutting concerns (logging, telemetry, caching, auth)
- Touches ≤3 files in a single architectural layer
- Leaves the branch-vs-base diff (three-dot against the base, so main
moving does not grow it) under the review window (
totem reviewnames the cut; 50000 characters of code today, not configurable)
Draft the design doc (Phase 3) if ANY of:
- Adds a new type, interface, or required field
- Adds a new state container or changes state ownership/lifecycle
- Introduces a new failure mode or changes existing error surface (hard error → warning, sync → async, blocking → non-blocking)
- Crosses architectural boundaries (core → cli, cli → mcp, etc.)
- Touches >3 files OR introduces a new cross-cutting concern
- Documents a new config field, new public API method, or new agent-facing tool surface (regardless of whether the doc is in the same PR as the implementation, and regardless of whether the implementation is yours or someone else's)
- Pushes the branch's diff past the review window, or a fold during the build does: a diff past the window is architectural on SIZE alone, because every reviewer, local and external, reads it in slices and review rounds scale with it. Re-triage when a fold crosses this line, and put the ride-or-split question to the operator WITH its price in rounds (mmnto-ai/totem#3114: a 26-file diff, re-triaged after two reads, took eight external rounds)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +10 lines 31ec97a075fc
- 1mo ago First seen · 163 lines · 26 tokens per session scan A 4621f694e963
preflight is a skill published in the GitHub repository mmnto-ai/totem (18 stars, last pushed today), licensed Apache-2.0. It adds 26 tokens to every session and 1,765 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
find-simplifications
Use for a periodic repo-wide sweep of qwen-code for accumulated excess surface — dead components and files, orphaned locale keys, exports nothing consumes, added-then-removed scaffolding — filing candidates on a tracking issue and landing only what a maintainer has said yes to. Repo-wide and evidence-first; every…
swarm-pr-review
Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…
code-review
You are a senior code reviewer. You receive diffs via stdin.
include-test-files-that-assert-on-behavior-being-changed-in-decl
When delegating a task affected by this skill, include.
agent-debug-ci
Investigate failed scheduled or nightly GitHub Actions runs on the default branch, determine whether the failure is reproducible and repository-owned, implement the smallest evidence-backed fix, validate it, and open a pull request. Use when a failed nightly CI event starts an agent, or when the standard CI or…
audit-ci
Run and analyze Elements cold CI performance profiles and propose evidence-backed build, test, lint, and dependency-graph improvements. Use whenever asked to profile or benchmark pnpm run ci, rerun ci:profile, create a CI performance audit, compare CI timings, find bottlenecks or the completion path, investigate a CI…