Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OutlineDriven/outline-driven-development --skill c-hardening-baselinegit clone --depth 1 https://github.com/OutlineDriven/outline-driven-developmentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/outlinedriven/outline-driven-development/c-hardening-baseline)<a href="https://agentmods.dev/skills/outlinedriven/outline-driven-development/c-hardening-baseline"><img src="https://agentmods.dev/badge/skills/outlinedriven/outline-driven-development/c-hardening-baseline/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/outlinedriven/outline-driven-development/c-hardening-baseline"><img src="https://agentmods.dev/badge/skills/outlinedriven/outline-driven-development/c-hardening-baseline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.03661 |
| Opus 5 | $0.00026 | $0.01831 |
| Sonnet 5 | $0.00011 | $0.00732 |
| Haiku 4.5 | $0.00005 | $0.00366 |
Grade A, and why
c-hardening-baseline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
C hardening baseline
This skill is a pure-C policy. It never prescribes a C++ idiom (RAII, destructors, smart pointers, lock guards, containers) as C practice. C++ code goes to modern-cpp-practices.
Contract
| Field | Bound contract |
|---|---|
| Trigger | C code is being written, audited, or hardened and the project needs one baseline for the C standard, undefined behavior, integer and buffer safety, the sanitizer and fuzzing matrix, and build and CI hardening flags. |
| Authority | Read-only. Writes nothing. Chat output only. No remote mutation. |
| Side effect | Emits a guidance report to chat. No source or build file is modified. |
| Done | The report names the C standard with the compiler that supports it, the undefined-behavior catalog with the sanitizer that traps each entry, the integer and buffer rules with their checked-arithmetic form, the hardening flag set the identified compiler accepts, the sanitizer and fuzzing jobs for CI, and the findings the audit checklist produced. |
Inputs
- C source code or build files (required): the code being written, audited, or hardened.
- Compiler vendor and version (required when not inferrable from build files): for example GCC 16.2 or Clang 23.1.0.
- Active C standard (required when not inferrable from build flags): the
-std=value or the project-agreed standard. - Existing warning, hardening, sanitizer, and fuzzing configuration (optional):
CMakeLists.txt,meson.build,Makefile, CI job files.
Procedure
-
Identify the compiler, its version, and the active C standard from build files (
CMakeLists.txt,meson.build,Makefile, compiler command lines) or from the inputs. Record whether the code is C++ anywhere in the tree. When the compiler or standard cannot be determined, report the ambiguity and stop. Done when: compiler, version, and standard are named, or the ambiguity is reported. -
Select the C standard. C23 (ISO/IEC 9899:2024) is the current published standard. Pin
-std=c23when the compiler accepts it. GCC 16.2 and Clang 23.1.0 both accept-std=c23. Fall back to-std=c17on an older toolchain and list which C23 controls the fallback loses (<stdckdint.h>,static_assertas a keyword,nullptr,[[nodiscard]]and the other standard attributes). Use-std=c23or-std=c17, not thegnuspellings, unless the code needs a GNU extension and a comment names it. Done when: the standard is selected and the compiler's support is recorded.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 120 lines · 53 tokens per session scan A 4a94c8d98ee0
c-hardening-baseline is a skill published in the GitHub repository OutlineDriven/outline-driven-development (52 stars, last pushed 3d ago), licensed Apache-2.0. It adds 53 tokens to every session and 3,661 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other skills, from other repositories
bounded-model-checking-c
Use when C or C++ code needs memory-safety or undefined-behavior guarantees proved with CBMC, or ACSL contracts checked with Frama-C Eva or WP. Not for choosing the proof policy: use proof-driven.
cpp-modules
C++20 modules skill for modern C++ projects. Use when working with named modules, module partitions, header units, CMake MODULESOURCES, Clang -fmodules-ts, BMI caching issues, or migrating from headers to modules. Activates on queries about C++20 modules, import statements, module interface units, header units, or BMI…
openmp
OpenMP skill for shared-memory parallel programming. Use when writing parallel for loops, reductions, task parallelism, SIMD directives, GPU offloading, or profiling with Score-P/TAU. Activates on queries about OpenMP, pragma omp, schedule static dynamic, reduction, false sharing, or OMPNUMTHREADS.
cpp
Use when writing modern C++ (17/20/23). Covers RAII, smart-pointer ownership, move semantics, ranges, concepts, and eliminating undefined behavior with sanitizers.
arduino-code-generator
Generate Arduino and embedded C++ snippets for sensors, actuators, buses, state machines, timing, data logging, and hardware abstraction. Use when a user requests implementation code and provide the exact board, framework, toolchain, pins, voltage, memory, and library versions first. Bundled templates target UNO…
unreal-gas
Expert guide for Unreal Engine 5.x Gameplay Ability System (GAS) C++ development. Covers AbilitySystemComponent, GameplayAbilities, GameplayEffects, Attributes/AttributeSets, GameplayTags, GameplayCues, AbilityTasks, prediction/replication, and common patterns. Use when the user asks about GAS, gameplay abilities…