Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nonlinear-xyz/factory-kit/factory-pitfallsnpx skills add nonlinear-xyz/factory-kit --skill factory-pitfallsgit clone --depth 1 https://github.com/nonlinear-xyz/factory-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nonlinear-xyz/factory-kit/factory-pitfalls)<a href="https://agentmods.dev/skills/nonlinear-xyz/factory-kit/factory-pitfalls"><img src="https://agentmods.dev/badge/skills/nonlinear-xyz/factory-kit/factory-pitfalls.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.02134 |
| Opus 5 | $0.00030 | $0.01067 |
| Sonnet 5 | $0.00012 | $0.00427 |
| Haiku 4.5 | $0.00006 | $0.00213 |
Grade A, and why
factory-pitfalls scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Factory pitfalls
The skills are now structured Principle → Why → Recipe → Failure mode, with each anti-pattern co-located with the principle it violates. This file is a flat scan across those failure modes plus process-level pitfalls that don't fit any one skill.
How to use this skill
- At project kickoff. Read this index; ensure the starting setup avoids the top-tier pitfalls (no test coverage, no DECISIONS.md, hardcoded allowlist).
- In code review. Scan recent diffs for matches; link the relevant skill section in the PR comment.
- After incidents. Add the failure mode to the skill where its principle lives (not here); if it doesn't fit any skill, add a process pitfall below.
Cross-skill failure index
Each entry: one line, pointing at the skill section that owns it.
Stack / architecture
- Mixed tRPC + server actions —
factory-api.md §API style — pick one - Custom auth adapter when an official one exists —
factory-auth.md §Better Auth — plugin composition - Triple-fallback auth surface (Clerk → token → header) —
factory-auth.md §The wrapper interface - No auth at all (
publicProcedureeverywhere) —factory-auth.md §Auth from day one - Hardcoded email allowlist —
factory-auth.md §Hardcoded email allowlists - Admin client at module scope —
factory-auth.md §Admin client — always wrapped
Forms
- Monolithic 1,500-line form —
factory-forms.md §Modular section files from day one
Testing
- No tests under
src/—factory-testing.md §Tests-before-merge — coverage gates, not test-first dogma - Mock-only tests passing while prod fails —
factory-testing.md §Test the boundaries; trust the framework - Snapshot tests as the only coverage —
factory-testing.md §E2E owns user flows; unit owns behavior
Frontend
- Two-way state-DB sync —
factory-frontend.md §One direction of truth - Currency formatting drift across views —
factory-frontend.md §Format helpers
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 149 lines · 59 tokens per session scan A c27ef29bb0ed
factory-pitfalls is a skill published in the GitHub repository nonlinear-xyz/factory-kit (9 stars, last pushed 1mo ago), licensed MIT. It adds 59 tokens to every session and 2,134 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hook-template
Generate hook script from template. Use when adding a new hook, wiring a PreToolUse/PostToolUse/Stop/Notification hook, or scaffolding hook config for settings.json.
agent-template
Generate custom agent from template. Use when creating a new subagent from scratch, or scaffolding an agent file with correct frontmatter.
workflow
Run the complete 5-step development workflow: focus problem → prevent over-development → test-first (TDD) → document → smart commit. Use when starting a new feature, or when the user runs /workflow or asks for the full development flow.
check-environment
Verify Claude, Codex, and Grok availability plus Director guidance, relay, agents, and skills. Audit optional hooks only when selected. Use after installation or when a native surface misbehaves.
doc-writer
Documentation templates and standards: README structure, API reference format, changelog (Keep a Changelog), and comment guidelines. Use when creating or updating documentation. Loaded automatically by the doc-writer agent.
smart-commit
Create clean Conventional Commits: inspect the diff, group related changes, run quality checks, and write type(scope) messages. Use when committing work, or when the user runs /smart-commit or asks to commit changes.