Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add punt-labs/punt-kit/plugin install punt-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/punt-labs/punt-kit/bead-review)<a href="https://agentmods.dev/skills/punt-labs/punt-kit/bead-review"><img src="https://agentmods.dev/badge/skills/punt-labs/punt-kit/bead-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/punt-labs/punt-kit/bead-review"><img src="https://agentmods.dev/badge/skills/punt-labs/punt-kit/bead-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.02154 |
| Opus 5 | $0.00016 | $0.01077 |
| Sonnet 5 | $0.00006 | $0.00431 |
| Haiku 4.5 | $0.00003 | $0.00215 |
Grade A, and why
bead-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bead-review — Full Backlog Audit
Review 100% of a repo's open beads, one at a time, in this same session,
against the per-bead rubric in references/per-bead-rubric.md. This is a
backlog cleanup pass, not implementation work — nothing gets fixed in
code here, only the beads describing the work get made accurate, clear,
and correctly prioritized (or closed if the work they describe is no
longer real).
No per-bead confirmation. The rubric makes the call on each bead autonomously. This skill's job is to enumerate, apply the rubric, reconcile, and produce one final report — not to relay N individual questions to the user.
Usage
args (optional): a repo directory to scope to (defaults to the current
working directory). Beads are stored in a shared org-wide database but
scoped per repo via .beads/metadata.json's prefix. To audit multiple
repos, invoke this skill once per repo; it does not fan out across repos
on its own.
Skill(bead-review) # audits the current repo
Skill(bead-review, args="../vox") # audits a sibling repo
Set REPO once at the start of the run: args if given, otherwise the
current directory. Never cd — every bd command below takes -C "$REPO" instead, so the skill works regardless of what tools are
allow-listed for the invoking command.
Step 1: Confirm scope
cat "$REPO/.beads/metadata.json" # confirm the prefix, sanity-check this is the right db
State the repo and prefix you're about to audit in one line before starting — this is not a confirmation question, just an announcement, so the run is legible if it's being watched.
Step 2: Enumerate every open bead
"Open" means any non-closed status, not just bd ready's narrower
no-blockers view — blocked and deferred beads still need clarity/validity
review even if they can't be worked yet. Do not add --all here — that
flag means "include closed issues too," the opposite of what this step
wants; the explicit --status list is the complete filter on its own:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 221 lines · 32 tokens per session scan A ff2f5e18c59a
bead-review is a skill published in the GitHub repository punt-labs/punt-kit (1 stars, last pushed yesterday), licensed MIT. It adds 32 tokens to every session and 2,154 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
traction-eos
Implement the Entrepreneurial Operating System (EOS) to align vision and execution across a company. Use when the user mentions "EOS", "Entrepreneurial Operating System", "V/TO", "quarterly rocks", "Level 10 meetings", "accountability chart", "IDS process", "my company feels chaotic", "we keep having the same…
promote-idea
Converts an album idea from IDEAS.md into an actual album project in one step. Use when the user says "promote [idea title]", "turn idea into album", or "start working on [idea]".
customer-onboarding-and-implementation
Takes a new customer from signature to working — setting a definition of live that both sides agreed before the contract was signed, planning and staffing the implementation, running data migration and integration realistically, training the people who will actually use it, and handing over to the ongoing…
vendor-management
Selects, contracts, and manages suppliers and vendors — requirements, evaluation, negotiation support, onboarding, performance management, and exit. Use this to choose a vendor, run a selection process, structure a service agreement's operational terms, manage an underperforming supplier, plan an exit or migration, or…
recap-doc
Post-development recap document generator. Use when: AI/Codex has implemented a feature and the user needs a guided walkthrough of what changed and why, with blind-spot detection and anticipated questions. Not for: Q&A follow-up (use /recap-ask), technical share-out for teammates (use /tech-brief), or generic code…
runbook
Generate and update feature release runbooks from existing docs and codebase. Use when: creating operational runbook, release handbook, deployment checklist, pre-release preparation. Not for: incident response (v2), code review (use codex-code-review), architecture design (use architecture).