Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/perhapsspy/project-legibility/structure-firstnpx skills add perhapsspy/project-legibility --skill structure-firstgit clone --depth 1 https://github.com/perhapsspy/project-legibilityWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.00547 |
| Opus 5 | $0.00046 | $0.00273 |
| Sonnet 5 | $0.00018 | $0.00109 |
| Haiku 4.5 | $0.00009 | $0.00055 |
Grade A, and why
structure-first scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 28 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Structure First
Find the owner. Trace the flow. Change the smallest responsible unit. Verify the contract.
Runtime Contract
- Choose the smallest current unit that owns the behavior or rule, not merely its symptom or output. State the intent and minimum observable completion condition. For a bug, establish the observable failure before restructuring.
- Trace only the needed path from caller through decision or state and write or effect to completion, using the form natural to the code. Include types, tests, docs, and config only when leaving them unchanged would break the behavior, contract, or meaningful verification.
- Name the structural demand—flow, lifecycle, decision/effect/completion ownership, composition, migration, or boundary contract—and the friction that blocks tracing or testing.
- Prefer focused local clarification. Change structure only when it removes total complexity or isolates an independently changeable responsibility; a shorter top level is not better when helpers, wrappers, context, state, errors, or lifecycle merely hide the complexity.
- Give each decision, writer, effect, and completion rule one discoverable, non-competing resolution path. Remove an old equivalent path in the same change; otherwise name the migration owner and exit condition.
- Verify observable behavior at the most stable responsible unit, not helper internals. Reopen only the smallest implicated unit when evidence shows that another unit owns part of the contract.
Keeping, inlining, merging, deleting, reordering, extracting, and making no structural change are all valid outcomes. Do not add future-use options, configuration, dependencies, wrappers, or abstractions.
Required Detail
Read Structural Boundaries before changing public I/O; decision, writer, effect, or completion ownership; async/state lifecycle; representation meaning; or migration paths.
Read Verification when a material claim crosses identity, authoritative data, representations, external writes, or runtime/async boundaries, or when a bug, refactor, or feature needs boundary evidence.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 28 lines · 91 tokens per session scan A 320a5ad04d06
structure-first is a skill published in the GitHub repository perhapsspy/project-legibility (5 stars, last pushed 4d ago), licensed MIT. It adds 91 tokens to every session and 547 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
author
Write a new doc in the right place with the right name. Use when asked to "write a doc", "where should this doc go", "add an ADR", "document this decision", "new spec", or "new feature plan".
router
Find the right doc before reading code. Use when asked "where is X documented", "is there a spec/ADR for X", "what's the roadmap", "open bugs", "read the docs about X", or "share the docs".
changelog
Record shipped work in the monthly changelog (append-only). Use when something ships or when asked "what changed", "add to changelog", "release notes", or "what shipped this month".
init
Set up docflow in a repo with no docs yet: scaffold the docs tree, write docflow.json, add agent guidance. Use when asked to "set up docflow", "initialize docs", "scaffold docs", or "make this repo use docflow".
check
Friendly docflow readiness check: one status, one reason, and the exact next command. Use when asked if docflow is set up, ready, or "what do I do next".
doctor
Read-only docflow diagnosis: scans docs, config, changelog, and links, then recommends init, adopt, or repair. Use when asked "check docs setup", "should I set up docflow", "why is docflow not working", or "doctor".