Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pactkit/claude-code-plugin/pactkit-drawnpx skills add pactkit/claude-code-plugin --skill pactkit-drawgit clone --depth 1 https://github.com/pactkit/claude-code-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00012 | $0.00982 |
| Opus 5 | $0.00006 | $0.00491 |
| Sonnet 5 | $0.00002 | $0.00196 |
| Haiku 4.5 | $0.00001 | $0.00098 |
Grade A, and why
pactkit-draw scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
The source is not reproduced here
No licence file
A repository with no LICENSE is all rights reserved by default, so the body is not copied here. The metadata, the measurements and the link are.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 82 lines · 12 tokens per session scan A 15a002b00f50
pactkit-draw is a skill published in the GitHub repository pactkit/claude-code-plugin (5 stars, last pushed 3d ago), with no licence file. It adds 12 tokens to every session and 982 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mstar-iteration
Use when starting, driving, resuming, or closing a Morning Star iteration, or running an autonomous Phase 1–5 loop — including without a slash command (e.g. 'start an iteration', 'drive the iteration', 'run an autonomous loop'). Manages Phase 1 (default interactive direction lock; opt-in autonomous), Autonomous…
mstar-branch-worktree
Morning Star 业务仓 Git 功能分支、worktree 隔离（L1 跨 plan：control worktree + 每 plan feature worktree + executionlease，默认 gitignore 下经 control 绝对路径读写进程产物；L2 同 plan：references/parallel-writable-pre-dispatch.md，N 次 invoke ≠ 隔离）、Spec 集成分支、QC/QA 检出对齐（Review cwd / Working branch / planid / Review range / Diff basis 三审 + QA 逐字相同）。Read…
mstar-coding-behavior
Morning Star 跨角色通用编码行为准则 —— 任何实现、调试、重构、审查任务动手前必读。约束 Think Before Coding（先读懂再改、显式假设、不静默猜测）、Simplicity First（YAGNI、The Ladder、simplify: 标记、最小耐久切片）、Surgical Changes（改动可追溯、Bug 修根因先 grep 所有调用点、不 piggyback）、Debugging（先复现、一步一测、修前写复现测试）、Review Feedback Handling（先核实再改、证据反驳）、Goal-Driven…
mstar-routing-eval
在同一会话或任务中首次 Read 本 skill 时：必须先 Read mstar-harness-core skill（SKILL.md，以及评估路由与门禁时需要的 mstar-harness-core/references/）。 本 skill 的 routing-evals.json 场景校验的是对 harness 的遵守情况；若未建立 harness 上下文，评估易与真实门禁脱节。冲突时 以 mstar-harness-core 为准。.
mstar-design-md
DESIGN.md design system specification for Morning Star projects. Create, audit, and maintain project-level design tokens (Colors, Typography, Spacing, Elevation, Motion, Shapes, Components, Voice & Content) using Vercel Geist as reference template. Three-level completeness checklist (MVP/Standard/Production) with…
mstar-project-governance
Morning Star 项目治理层约定 —— projects/ /roadmap.md 编写约定（frontmatter schema + body 约定）与 projects/ /residuals.json register 生命周期（open → verified close in place、severity 枚举、provenance 字段）、default 项目回退规则。写/审 roadmap、登记或关闭 residual、判断项目归属（含无项目流程的 default fallback）、或对齐 roadmap/register 与 engine 校验时 Read。schema 事实与…