north-star

north-star is a skill for Claude Code, Codex from mollyretter/forward-deployed-engineer-toolkit. It costs 89 tokens per session (5,322 once invoked), scanned A, original, MIT.

A guided starting exercise for defining a new project's purpose, approach, and intended users. It creates a short north-star document and a detailed build log.

In plain words
What is it for?
Clarifying a new project, business, or pivot through three questions, or deliberately revising an existing direction in drift mode.
Why use it?
It turns early, informal intentions into a written reference that later project work can use.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions CLAUDE.md; mentions Claude Code.

Good fit Clarifying a new project, business, or pivot through three questions, or deliberately revising an existing direction in drift mode.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/mollyretter/forward-deployed-engineer-toolkit/north-star
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add mollyretter/forward-deployed-engineer-toolkit --skill north-star
Clone the repo
git clone --depth 1 https://github.com/mollyretter/forward-deployed-engineer-toolkit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for north-star

README.md
[![agentmods](https://agentmods.dev/badge/skills/mollyretter/forward-deployed-engineer-toolkit/north-star/github.svg)](https://agentmods.dev/skills/mollyretter/forward-deployed-engineer-toolkit/north-star)
Your own site
<a href="https://agentmods.dev/skills/mollyretter/forward-deployed-engineer-toolkit/north-star"><img src="https://agentmods.dev/badge/skills/mollyretter/forward-deployed-engineer-toolkit/north-star/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for north-star

Your own site · 80×15
<a href="https://agentmods.dev/skills/mollyretter/forward-deployed-engineer-toolkit/north-star"><img src="https://agentmods.dev/badge/skills/mollyretter/forward-deployed-engineer-toolkit/north-star.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 89 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,322 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00089 $0.05322
Opus 5 $0.00044 $0.02661
Sonnet 5 $0.00018 $0.01064
Haiku 4.5 $0.00009 $0.00532

Measured 8d ago against content hash e20c6c255abd, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

north-star scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (schema.test.ts, schema.ts), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/north-star/SKILL.md · 229 lines

How it starts

The opening of the file, as written. The whole thing — 229 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/north-star — turn the founder's feelings and intentions on day 1 into a locked day-1 artifact

When to use

At the very beginning of a new project, business, or pivot, before brand, scope, or implementation work. Or later, in drift mode, when the existing north-star isn't working anymore and the founder explicitly wants to revise.

Skip for: features (those use the project's feature skill if one exists), pure technical decisions (use ADRs directly), marketing campaigns (downstream).

What it produces

Three artifacts:

  1. <project>/docs/00-north-star.md — a short paragraph (3 to 5 sentences) capturing what / why / for-whom, the approach, and the philosophical posture. YAML frontmatter at the top makes the paragraph machine-readable for downstream apps. Real-world mission statements (Patagonia, Amazon) are 1 to 3 sentences; aim there. The 3-to-5-sentence count is the authoritative bar; line count is incidental.

  2. <project>/docs/build-logs/north-star-v{N}.md — full session record: founder's verbatim answers to each interview question, scratch synthesis attempts, cross-model review findings, draft evolution v1 to vN with rejection reasons, and a consolidated Positioning context for downstream skills section.

  3. (Optional) 1 to 3 foundational ADRs in <project>/docs/adrs/ for durable bright-line decisions surfaced during the interview that warrant separable, citable records.

Downstream skills (e.g. feature) read (1) and (2) at requirements-gathering time to check alignment before scoping new work.

Hard rules

  1. Self-interview, not interrogation. Capture the founder's literal language. Don't paraphrase, don't generate from templates, don't put words in their mouth.
  2. Pointed questions, not vague ones. Each question elicits a felt answer, not an analytical one.
  3. No drift into brand, voice, pricing, scope, or marketing. All downstream. If the founder veers, redirect with a script: "That's worth holding onto, but for now I'm parking it. Right now I'm only after what / why / who and the deepest beliefs. We'll come back to that." Park stray thoughts in build-log notes.
  4. Short artifact. 3 to 5 sentences in the paragraph. Resist the urge to produce a polished document; polish comes through months of iteration.
  5. Read aloud or it doesn't ship. The founder reads the paragraph aloud. If it sounds like them, lock. If not, edit.
  6. Founder edits the file directly once a draft exists. Iterate the first draft conversationally in chat. The moment a working draft exists, open docs/00-north-star.md in their editor (code <path>, $EDITOR <path>, or whatever they use) and let them edit there. Quality jumps once the founder is in their own editor; chat-based list confirmations are explicitly forbidden.
  7. Positive commitments only in the artifact. No "we don't" or "we are not for" framing in the paragraph; that reads judgy. Specific anti-patterns to avoid in synthesis:
    • Defensive hedging in the headline (e.g. "...not get skinny" — even if the founder said it, putting it in the headline turns the orientation into an argument with the customer's possible motivations)
    • "We don't do X" framing in beliefs (replace with positive commitments that imply the bright line)
    • "Who we are NOT for" as a section heading (use "What to expect" or fold into positioning context as expectation-setting) Bright lines and counter-personas live in the build log's positioning-context section.
  8. Locked-but-revisable. Drift-mode re-run requires the founder to explicitly name what's drifted; old version is archived, not deleted.
  9. Ideal pace is one sitting, no hard cap. Most runs land in one focused session. Some genuinely take two. There is no enforced limit; if a session is going long, take a break and resume rather than rushing.
  10. Stop-or-go is allowed. If Q3 (founder-market fit) makes the founder realize they shouldn't be building this, surface that, don't push through to a locked artifact. (This rule is designed but not yet exercised in real-world use.)
  11. Cross-model review is required at lock; optional at any point during the run. Mid-flight reviews (single different-model agent at any point the interviewer or founder wants a sanity check) caught real drift in the inaugural run. The pre-lock review is a fan-out across multiple models (Sonnet + Opus + Haiku) for confidence on the final paragraph. See Phase 4.
  12. Build log uses verbatim quotes for founder language. When the interviewer's notes summarize what the founder said, mark it explicitly as a summary; the verbatim founder answers are the source of truth for downstream skills. Don't paraphrase silently.
  13. Founder overwhelm is a course-correction trigger. If the founder says "this is a lot," "this is overwhelming," or similar, stop the current approach and find a smaller surface. Don't push through. The most common moment this fires is when the interviewer is presenting list-mode confirmations; the right correction is to skip lists and let the founder react to a draft instead.

Read the full file on GitHub · 229 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 229 lines · 89 tokens per session scan A e20c6c255abd

Subscribe to this mod's changes

north-star is a skill published in the GitHub repository mollyretter/forward-deployed-engineer-toolkit (9 stars, last pushed 17d ago), licensed MIT. It adds 89 tokens to every session and 5,322 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

skill-builder

Automatically detect source types and build AI skills using Skill Seekers. Use when the user wants to create skills from documentation, repos, PDFs, videos, or other knowledge sources.

yusufkaraaslan/Skill_Seekers · 38 tokens

offensive-advanced-redteam

Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC…

SnailSploit/Claude-Red · 146 tokens

offensive-crypto-attacks

Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and…

SnailSploit/Claude-Red · 261 tokens

offensive-c2-frameworks

Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across…

SnailSploit/Claude-Red · 250 tokens

offensive-dependency-confusion

Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI…

SnailSploit/Claude-Red · 234 tokens

offensive-parameter-pollution

HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.

SnailSploit/Claude-Red · 0 tokens