Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add n-n-code/n-n-code-skills --skill project-vendor-boundarygit clone --depth 1 https://github.com/n-n-code/n-n-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/n-n-code/n-n-code-skills/project-vendor-boundary)<a href="https://agentmods.dev/skills/n-n-code/n-n-code-skills/project-vendor-boundary"><img src="https://agentmods.dev/badge/skills/n-n-code/n-n-code-skills/project-vendor-boundary.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00526 |
| Opus 5 | $0.00021 | $0.00263 |
| Sonnet 5 | $0.00008 | $0.00105 |
| Haiku 4.5 | $0.00004 | $0.00053 |
Grade A, and why
project-vendor-boundary scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Vendor Boundary
This is a composable project overlay. Add matching implementation guidance when the work requires language-specific code judgment.
For review, inspect provenance, local patches, and integration behavior without updating, fetching, or replacing the vendor tree. During implementation, preserve pre-existing local changes and apply only the requested integration or update.
When to use
The change involves checked-in third-party source, a subtree or submodule, a vendor directory, copied sources, a local vendor patch, or the app-owned adapter around that material.
Not for
Do not use this for ordinary package-manager version or lockfile changes with no
checked-in third-party source, app-owned code unrelated to the integration seam,
or generated outputs that must be changed through their generator. Use
project-release-maintainer for release concerns and compose it only when a
vendor change also affects shipped metadata. Use security first when exploit
review is the primary job.
Workflow
- Classify the material before editing: app-owned source, checked-in vendor source, submodule, generated output, or package-managed dependency. Read the repository's update instructions, provenance record, patch convention, and license or notice files when they exist.
- Prefer an adapter or wrapper change in app-owned code when the integration seam can reasonably absorb it. Patch vendor source only when the seam cannot solve the problem without distorting the app contract.
- Keep vendor patches minimal. Avoid unrelated formatting, generated churn, mass mechanical rewrites, or local style normalization inside the vendor tree. Record the upstream source or base version and patch rationale using the repository's existing convention.
- Validate the app-owned seam and the narrowest relevant vendor build or test path the repo supports. Inspect the final diff for accidental vendor churn.
- Update notices, provenance, upstream version, local patch records, install rules, or shipped metadata only when the vendor change affects them; do not rewrite these files for an app-only adapter change.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +4 lines 8c78df01d59b
- 8d ago First seen · 49 lines · 42 tokens per session scan A 5d48114f935d
project-vendor-boundary is a skill published in the GitHub repository n-n-code/n-n-code-skills (4 stars, last pushed 2d ago), licensed MIT. It adds 42 tokens to every session and 526 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
audit-pr
Audit a whole PR against the delivery contract and return MERGE-READY or evidenced blockers with the full URL. Consumes the current review-change REVIEW-PASS receipt instead of re-running review axes; posts a SHA-bound ready comment; never edits or merges. Triggers: "audit-pr", "is this PR ready", "merge gate".
design-feature
Turn a raw idea or existing feature into a designed product SPEC by completing entity, integration, role, and expectation closure. Upserts never destroy recorded decisions. Triggers: "design-feature", "design this feature", "define product scope".
plan-feature
Route designed features or issues into engineering planning and roadmap registration; undesigned work stops at design-feature. Supports --next, --from-issue, and --scaffold. Triggers: "plan-feature", "plan a feature", "plan the next roadmap feature", "create SPEC and TASKS".
product-audit
Audit the whole product across code, quality, process, docs, roadmap, and tooling. Persist one severity-ranked, F-numbered report with proposals; never fix or file work. Triggers: "product-audit", "audit the product", "full health check", "are we product-ready", "CTO review".
audit-docs
Audit cross-document coherence: docs ↔ roadmap ↔ code ↔ fix index ↔ issues. Finds drift — features in docs/ not in the roadmap (or vice versa), fix-index entries already merged/closed, broken documentation-map links, dependency cycles, artifacts in the wrong language, naming-convention violations — and reports them…
init-workspace
Adapt the workflow scaffold to a new repository or add only missing substrate blocks to an existing install. Every install, hook, and overwrite needs explicit consent. Triggers: "init-workspace", "set up agentic workflow", "upgrade workflow scaffold".