Borrowing it
Nothing to install: this file belongs to opencue/cuecards. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/opencue/cuecards/main/.agents/skills/vc-scenario/SKILL.mdgit clone --depth 1 https://github.com/opencue/cuecardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/opencue/cuecards/vc-scenario)<a href="https://agentmods.dev/skills/opencue/cuecards/vc-scenario"><img src="https://agentmods.dev/badge/skills/opencue/cuecards/vc-scenario.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01033 |
| Opus 5 | $0.00015 | $0.00517 |
| Sonnet 5 | $0.00006 | $0.00207 |
| Haiku 4.5 | $0.00003 | $0.00103 |
Grade A, and why
vc:scenario scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vc:scenario — Edge Case & Scenario Explorer
Decompose any feature or code path across 12 dimensions to surface edge cases, risks, and test targets before implementation begins.
When to Use
- Before implementing complex or stateful features
- Before writing tests (generates test targets)
- Risk assessment during planning or code review
- API design review — surface contract edge cases early
When NOT to Use
- Trivial single-line changes or cosmetic UI tweaks
- Already well-tested, stable code with no recent modifications
- Pure configuration changes with no logic paths
12 Decomposition Dimensions
Not all 12 apply to every feature. Identify relevant dimensions first, then generate scenarios only for those.
| # | Dimension | What to Look For |
|---|---|---|
| 1 | User Types | admin, guest, banned, new user, power user, bot/scraper |
| 2 | Input Extremes | empty, null, max length, unicode, special chars, SQL/script injection |
| 3 | Timing | concurrent access, race conditions, timeout, slow network, retry storms |
| 4 | Scale | 0 items, 1 item, 1M items, pagination boundary, cursor wrap |
| 5 | State Transitions | first use, mid-flow abort, resume after crash, partial completion |
| 6 | Environment | mobile/low-end CPU, no JS, screen reader, proxy/VPN, different timezone/locale |
| 7 | Error Cascades | DB down, API timeout, disk full, OOM, network partition, partial write |
| 8 | Authorization | expired token, wrong role, shared/public link, CORS, CSRF, privilege escalation |
| 9 | Data Integrity | duplicate entries, orphan references, encoding mismatch, concurrent schema migration |
| 10 | Integration | webhook replay, API version mismatch, third-party outage, contract drift |
| 11 | Compliance | GDPR deletion request, audit logging gap, data retention, accidental PII exposure |
| 12 | Business Logic | edge pricing (zero/negative), coupon stacking, refund after partial delivery, free tier limits |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 114 lines · 30 tokens per session scan A de1774b08021
vc:scenario is a skill published in the GitHub repository opencue/cuecards (5 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 1,033 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
atomic-tdd
Test-first discipline. Auto-triggers on "let's implement X", "add feature Y", "fix bug Z", "write a test for", "implement", "build out", and similar pre-code-change phrases. Iron rule: failing test exists before production code. Skip only for pure docs/config changes with an explicit "skipped because:" note. Explicit…
verify
Verify a code change by running the app, the relevant command, or a focused server flow and reporting concrete evidence.
api-endpoint
Generate a complete REST API endpoint with validation, tests, and documentation.
generate-tests
Generate comprehensive tests for a file or function.
safe-extraction
Apply when extracting code from a large monolith file into submodules. Covers barrel re-exports, internals DI seam proxy patterns, CI invariant allowlist updates, and cross-file test verification. Prevents CI failures, broken imports, and test regressions from code extraction.
verify
Runs this project's check chain through scripts/verify.py and reads the receipt it writes. Fires when tracked changes are finished, when the user asks whether work passes, before a commit, and before reporting a task done. Stays dormant in repositories with no detectable check chain, during read-only audits, and for…