Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mshadmanrahman/pm-pilot --skill shepherd-startgit clone --depth 1 https://github.com/mshadmanrahman/pm-pilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mshadmanrahman/pm-pilot/shepherd-start)<a href="https://agentmods.dev/skills/mshadmanrahman/pm-pilot/shepherd-start"><img src="https://agentmods.dev/badge/skills/mshadmanrahman/pm-pilot/shepherd-start.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01173 |
| Opus 5 | $0.00026 | $0.00587 |
| Sonnet 5 | $0.00010 | $0.00235 |
| Haiku 4.5 | $0.00005 | $0.00117 |
Grade A, and why
shepherd-start scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/shepherd-start {TICKET-ID} — Bug Investigation Session
Begin a focused investigation session for a single bug. This command sets up context, loads institutional memory, and prepares a structured investigation plan.
Audience: PMs, designers, or developers. No code knowledge required for investigation; code knowledge only needed if you plan to fix it yourself.
Arguments
{TICKET-ID}(required): The bug tracker ID (e.g., PROJ-1234, #456)
Workflow
1. Load Configuration
Read .claude/triage.config.yaml for project settings. If it does not exist, run
the first-run setup in /shepherd-sync step 1 to create it from the bundled
template, then continue.
2. Pre-Flight Checks
- If
team.git_emailis set, verify:git config user.emailmatches. If not, warn:"Git email mismatch. Expected: {git_email}, Got: {actual}." "Fix: git config user.email {git_email}" - Verify clean working directory:
git status --porcelain. If dirty:"Working directory has uncommitted changes. Commit or stash before starting a new session." - Check that we're on main/master branch. If not, warn.
3. Auto-Sync Backlog
If .claude/backlog-live.md doesn't exist or is older than 24 hours, run /shepherd-sync first.
4. Pull Full Bug Details
Load the appropriate adapter and fetch complete bug details:
For Jira:
- Title, description, priority, status, assignee, reporter
- All comments (chronological)
- Attachments and screenshots
- Linked issues
- Sprint history
For Linear:
- Title, description, priority, status, assignee
- Comments and activity
- Related issues
For GitHub Issues:
- Title, body, labels, assignees
- All comments
- Linked PRs
5. Create Working Branch (if developer session)
Only if the user intends to fix (not just investigate):
git checkout main && git pull origin main
git checkout -b fix/{TICKET-ID}-{slug}
Where {slug} is a kebab-case summary (max 5 words from the title).
6. Load Institutional Memory
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +2 lines · +13 tokens per session 18400e4cb83a
- 8d ago First seen · 151 lines · 39 tokens per session scan A 0b63f365aee1
shepherd-start is a skill published in the GitHub repository mshadmanrahman/pm-pilot (20 stars, last pushed 2d ago), licensed MIT. It adds 52 tokens to every session and 1,173 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
g-doctor
Read-only health diagnostics for G-Forge projects — 25 checks including hook registration, installed-copy drift, Check 23 plugin-version-lag, Check 24 CLAUDE.md injection-rule compliance, and Check 25 integration-tier guard. Recommends /plugins or /g-update by direction. Never writes.
linear-update
Update Linear issues with debugging findings. Add comments, change status, update labels, set priority. Use after completing investigations.
issue-triage
Triage a bug or Jira ticket into ranked root-cause candidates and proposed solution paths. Read-only unless the user opts in to publish. Use when the user says "triage this", "triage [TICKET-KEY]", "what's causing this bug", "help me find the root cause", or invokes /issue-triage.
triage-issue
Analyze a GitHub issue, verify claims against the codebase, and close invalid issues with a technical response.
bug-triage
Read all open bugs in production/qa/bugs/, re-evaluate priority vs. severity, assign to sprints, surface systemic trends, and produce a triage report. Run at sprint start or when the bug count grows enough to need re-prioritization.
review-loop
Run the adversarial verification loop — implement, then hand the change to a fresh checker that did not write it, fix what it finds, and re-dispatch until APPROVE. Use before claiming any behavioural change is done, and on requests like "review loop", "adversarial review", "independent review", "get this verified"…