Borrowing it
Nothing to install: this file belongs to petarzarkov/dunx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/petarzarkov/dunx/main/.claude/skills/spike/SKILL.mdgit clone --depth 1 https://github.com/petarzarkov/dunxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/petarzarkov/dunx/spike)<a href="https://agentmods.dev/skills/petarzarkov/dunx/spike"><img src="https://agentmods.dev/badge/skills/petarzarkov/dunx/spike.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.00645 |
| Opus 5 | $0.00037 | $0.00322 |
| Sonnet 5 | $0.00015 | $0.00129 |
| Haiku 4.5 | $0.00007 | $0.00064 |
Grade A, and why
spike scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/spike
Every constraint in the Verified constraints section of docs/ARCHITECTURE.md was measured, not reasoned about. That is why the decisions above it hold. A spike keeps that property.
Procedure
- State the question as a falsifiable claim and name what it gates. From
docs/architecture/constraints.md: "does
@Post(path, { body: Schema })constrain the method signature through the method decorator's generic?" gates Phase 3. "Does theWeakMappending-drain survive subclassed controllers withoutSymbol.metadata?" gates Phase 2. - Write a throwaway probe in the scratchpad directory, never under
packages/orexamples/. It is not code that ships and it must not reach a commit, a coverage run, or a build. - Run it on real Bun and record
bun --versionalongside the output. - Delegate the probing when it is noisy or wide. Give a subagent the claim and the probe location; ask back for the literal command, the literal output, and a one-line verdict. Iterating a decorator probe through six type errors is exactly the kind of output that should never enter the main thread.
- Record the result in docs/ARCHITECTURE.md:
- confirmed → a Verified constraints entry with the command, the Bun
version, and the literal output in a fenced block. Match the existing
terseness - the
paramtypes: [ "Db", "Object", "Number" ]entry is the model. - refuted → write down the fallback and why, under the decision it affects. A rejected approach recorded is the whole point of that document.
- Remove the item from Spikes to resolve. A resolved spike left listed is worse than no list.
- confirmed → a Verified constraints entry with the command, the Bun
version, and the literal output in a fenced block. Match the existing
terseness - the
- Delete the probe.
Rules
- Never write "should work", "presumably", or "in theory" into docs/ARCHITECTURE.md. If it was not run, it does not go in.
- A spike that changes the public API shape belongs before the code it gates, not after.
- One spike, one claim. Two questions are two probes.
- Probes may use anything - including the dialects this repo bans in shipped code
(
experimentalDecorators,reflect-metadata) if refuting them is the point. That is how the existingemitDecoratorMetadataentry was produced. Scratchpad only.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 49 lines · 74 tokens per session scan A 0de155160343
spike is a skill published in the GitHub repository petarzarkov/dunx (111 stars, last pushed yesterday), licensed MIT. It adds 74 tokens to every session and 645 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…
bun
Use this skill when building with Bun runtime — Bun APIs, testing, package management, shell scripting, hot reload, SQLite, file I/O. This skill enforces: built-in APIs over npm equivalents, Bun test runner, bun install speed optimization, Bun.shell for scripts. Do NOT use for: Node.js-specific APIs…
nifra
Use when writing, reviewing, or debugging code in a Nifra project (@nifrajs/ packages, nifra CLI, server()/defineContract, loaders and actions, file routes under routes/). Explains how to reach Nifra's live MCP tools so signatures come from the installed version instead of memory, and which sibling skill to load for…
express-prisma-pattern
House pattern for Express + Prisma backends structured as manual Clean Architecture (controller → usecase → repository, wired by hand in a factory) — the real shape of dream-book-api and simple-management-api. Use whenever creating a new route, usecase or domain in an Express backend on this stack, even if the request…
api-errors
McpError constructor, JsonRpcErrorCode reference, and error handling patterns for @cyanheads/mcp-ts-core. Use when looking up error codes, understanding where errors should be thrown vs. caught, or using ErrorHandler.tryCatch in services.
Node Expert
Node Expert delivers production-grade technical work with clear architecture, tests, maintainability, and operational awareness.