Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/petekp/claude-code-setup/spikenpx skills add petekp/claude-code-setup --skill spikegit clone --depth 1 https://github.com/petekp/claude-code-setupWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/petekp/claude-code-setup/spike)<a href="https://agentmods.dev/skills/petekp/claude-code-setup/spike"><img src="https://agentmods.dev/badge/skills/petekp/claude-code-setup/spike.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00192 | $0.01909 |
| Opus 5 | $0.00096 | $0.00955 |
| Sonnet 5 | $0.00038 | $0.00382 |
| Haiku 4.5 | $0.00019 | $0.00191 |
Grade A, and why
spike scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spike
A spike is not a small implementation. It is an experiment that buys information, and the code is the apparatus, not the product. The value ships in the findings; the code gets deleted.
Holding that distinction is the whole skill. The failure mode is not writing bad spike code — bad spike code is correct. The failure mode is drifting: starting with a question, getting something working, and quietly sliding into building the feature. That produces shortcut-quality code that nobody dares delete and nobody wants to own.
The contract
- A spike answers questions. If you cannot state what you'd learn, it isn't a spike.
- The code is disposable and is actually disposed of. Torn down when the findings are written.
- Nothing from the spike is promoted. The real implementation is written fresh, informed by what was learned. Copying spike code forward smuggles the shortcuts into production.
- A null result is a result. "This approach can't work because X" is a successful spike, often the most valuable kind. Never twist a spike toward a positive answer.
Step 1 — Name the unknowns before writing anything
Turn the vague ask ("let's spike the new sync layer") into a short numbered list of questions that could come back no. Then state them and start. Don't wait for approval — but do state them, because if you picked the wrong questions the user can redirect you in one sentence, and that's far cheaper than finding out at the end.
A real spike question is falsifiable and decision-changing. Apply both tests:
- Falsifiable — there's an observation that would settle it. "Is the architecture good?" fails. "Does the batch endpoint return partial failures per-item or fail the whole batch?" passes.
- Decision-changing — write down what you'd do differently for each answer. If both answers lead to the same plan, drop the question; you're about to spend effort on something you already know how to handle.
Common shapes worth reaching for:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 155 lines · 192 tokens per session scan A 0c6f9bf8f75f
spike is a skill published in the GitHub repository petekp/claude-code-setup (45 stars, last pushed 27d ago), licensed MIT. It adds 192 tokens to every session and 1,909 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
html-artifacts
Author the HTML for a plan artifact, dashboard iframe, or Slack attachment — structure, design plan, available runtime, theming, and craft. Read this before writing HTML for saveplan, outputiframe, or slackattachhtml.
bootstrap-repo-analysis
First-time analysis of a repository with no prior reviewer outcomes. Crawl historical merged-PR review feedback with the gh CLI (plus any preloaded samples), extract the team's review norms, and synthesize the initial per-repo review-style prompt. Use this for a cold-start repo; use continual-learning instead once the…
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
continual-learning
Nightly refinement of an existing per-repo review-style prompt using this reviewer's own finding outcomes. Read confirmed (resolved-by-commit / thumbs-up) and dismissed (thumbs-down) findings, promote the bug patterns the team actually fixes, demote the false-positive patterns, reconcile against the current prompt…
AI & LLM Security
LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments.
official-document-writing
专业的党政机关公文写作指南。当用户需要撰写、修改或审核党政机关公文(如请示、通知、函、总结、纪要等)时使用。提供GB/T 9704-2012格式规范指导、常用公文模板、语言规范建议和公文质量检查。适用于以下场景:(1) 撰写新公文,(2) 修改完善公文,(3) 检查公文格式规范,(4) 提供公文写作指导,(5) 审核公文质量。.