Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/onewave-ai/open-agent-stack/handoffnpx skills add OneWave-AI/open-agent-stack --skill handoffgit clone --depth 1 https://github.com/OneWave-AI/open-agent-stackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.00568 |
| Opus 5 | $0.00030 | $0.00284 |
| Sonnet 5 | $0.00012 | $0.00114 |
| Haiku 4.5 | $0.00006 | $0.00057 |
Grade A, and why
handoff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 25 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Handoff
The app works and only one person knows why. That is fine until it is a client deliverable, a contractor's starting point, or a Monday six months from now. Handoff is the pass that moves the knowledge out of the head and into the repo.
Workflow
- Prove the cold start. Clone into a fresh directory and follow your own setup instructions exactly as written -- no memory, no shortcuts. Every step that fails or requires unwritten knowledge is a documentation bug. This single test catches most of what handoff docs get wrong.
- Write the honest README. What the app does in two sentences, the stack, how to run it, how to deploy it, what every environment variable is and where to get its value. Then the sections people leave out: what is stubbed, what is intentionally simple, and what will break first under load.
- Record the decisions. A short
DECISIONS.md: why this database, why this auth, why the odd-looking workaround in that one file. Undocumented decisions get "cleaned up" by the next developer, and then the bug they were preventing comes back. - Map the code. A brief tour: where routes live, where shared components live, where the data layer is, and the two or three files that matter most. New developers do not need every file explained -- they need to know where to start reading.
- Hand over the keys, safely. Inventory every account and service the app depends on (hosting, database, domain, email, payments, analytics) with who owns it today and what has to transfer. Credentials move through a secure channel, never the repo, never chat. Rotate anything that has been shared loosely.
Rules
- Document what is true today, not the roadmap. Aspirational docs are worse than none because they get trusted.
- Every known gap gets written down. A listed shortcut is a decision; a hidden one is a trap.
- Delete dead code and unused dependencies before handing over -- the new developer cannot tell what is load-bearing and will preserve all of it.
- Setup instructions that only work on your machine are not instructions. If it needs a specific version, pin it and say so.
- If the app is going to a client, include the plain-language answer to "what can I change safely myself" -- copy, images, content -- and what needs a developer.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 25 lines · 60 tokens per session scan A 9ab9fa9ce89e
handoff is a skill published in the GitHub repository OneWave-AI/open-agent-stack (2 stars, last pushed 22d ago), licensed MIT. It adds 60 tokens to every session and 568 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
baoyu-article-illustrator
Article illustrations: type × style × palette consistency.
pixel-art
Pixel art w/ era palettes (NES, Game Boy, PICO-8).
mcporter
List, auth, and call MCP servers/tools from the terminal.
export
Exports all project memories to a portable Markdown file for backup or migration. Use when backing up memories, migrating to another project, sharing memory state with teammates, or archiving before cleanup.
context-loader
Searches and injects relevant memories into context before starting work on a task. Use when beginning a new task, switching context, or when project history, past decisions, or coding conventions need to be loaded.
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.