Borrowing it
Nothing to install: this file belongs to Othmane-Khadri/YALC-the-GTM-operating-system. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Othmane-Khadri/YALC-the-GTM-operating-system/main/.claude/skills/yalc-orientation/SKILL.mdgit clone --depth 1 https://github.com/Othmane-Khadri/YALC-the-GTM-operating-systemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/othmane-khadri/yalc-the-gtm-operating-system/yalc-orientation)<a href="https://agentmods.dev/skills/othmane-khadri/yalc-the-gtm-operating-system/yalc-orientation"><img src="https://agentmods.dev/badge/skills/othmane-khadri/yalc-the-gtm-operating-system/yalc-orientation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/othmane-khadri/yalc-the-gtm-operating-system/yalc-orientation"><img src="https://agentmods.dev/badge/skills/othmane-khadri/yalc-the-gtm-operating-system/yalc-orientation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 51 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Agent Snooping · line 10 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium MCP Rug Pull · line 51 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00158 | $0.01113 |
| Opus 5 | $0.00079 | $0.00557 |
| Sonnet 5 | $0.00032 | $0.00223 |
| Haiku 4.5 | $0.00016 | $0.00111 |
Grade A, and why
yalc-orientation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
YALC Orientation
A new user just opened this repo. Walk them through a 4-step orientation so they know what YALC is, that their environment is ready, and which capability fits their first job.
Do NOT duplicate setup logic. If the user needs to install or configure, hand off to the existing /setup skill at .claude/skills/setup/SKILL.md.
Step 1 — Overview
Read CLAUDE.md at the repo root and surface the "What YALC is" section to the user. Quote or paraphrase it — that file is the single source of truth, DO NOT duplicate the text into this skill body. Keep the intro to 3–5 sentences. End with one sentence framing the architecture split: "Read context from your knowledge base, execute from this repo."
Step 2 — Prerequisite check
Run these checks silently and report only what's missing. If everything passes, say "environment looks good" and continue.
- Node ≥ 20 (
node --version). ~/.gtm-os/exists (test -d ~/.gtm-os).~/.gtm-os/.envis non-empty (test -s ~/.gtm-os/.env).yalc-gtmis resolvable on PATH (which yalc-gtm).
For each failure, surface the specific fix from CLAUDE.md "Common stuck states":
yalc-gtmnot on PATH →npm i -g yalc-gtm-os(orpnpm link --globalfrom the repo root if hacking on YALC itself).~/.gtm-os/missing or.envempty → runyalc-gtm startto scaffold; the CLI writes the template and opens it for editing.- Localhost won't open → confirm
yalc-gtm startexited cleanly, copy the URL from the terminal banner, check port 3847 isn't taken (lsof -i :3847). - Node < 20 → upgrade via nodejs.org.
If ~/.gtm-os/ is not initialized, route to /setup immediately regardless of what the user says next. The /setup skill owns install + scaffold + key entry + capture + preview + commit + doctor + framework recommendation. Don't reimplement any of it here.
Step 3 — Intent question
Once prerequisites pass, ask the user this exact question with 4 multi-choice options:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 62 lines · 158 tokens per session scan A afb5fc05c657
yalc-orientation is a skill published in the GitHub repository Othmane-Khadri/YALC-the-GTM-operating-system (301 stars, last pushed 23d ago), licensed MIT. It adds 158 tokens to every session and 1,113 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
kn-handoff
Use when a feature crosses repository boundaries and one side must hand work to the other - generates a self-contained frontend-to-backend brief or backend-to-frontend API contract.
deepline-quickstart
Run a quick Deepline demo recipe to show the user how Deepline works.
k-teach
Create or revise source-grounded lessons, exercises, learning pages, WeChat articles/drafts, and HTML slide decks. Use for teaching content, learning assets, official-account content, or PPT-style presentations.
pm-teaching-mode
Comprehensive teaching templates and progressive disclosure patterns for PM teacher mode.
task-management
Prioritize tasks, detect overdue items, and help with daily planning.
research-methodology
Systematic approach to investigating topics, evaluating sources, and synthesizing findings.