Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add qGolem/orc --skill archgit clone --depth 1 https://github.com/qGolem/orcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qgolem/orc/arch)<a href="https://agentmods.dev/skills/qgolem/orc/arch"><img src="https://agentmods.dev/badge/skills/qgolem/orc/arch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qgolem/orc/arch"><img src="https://agentmods.dev/badge/skills/qgolem/orc/arch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.04599 |
| Opus 5.5 | $0.00010 | $0.01840 |
| Sonnet 5.5 | $0.00005 | $0.00920 |
| Haiku 4.5 | $0.00002 | $0.00460 |
Grade B, and why
arch scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Strips warnings and disclaimersmediumAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
- [ ] Compiles without warnings How it starts
The opening of the file, as written. The whole thing — 569 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Arch — Rust Project Orchestrator
Multi-phase Rust project architect. Gathers requirements interactively, designs architecture using rust-architect patterns, implements with rust-expert knowledge, then spawns a parallel review wave with rust-skills + cargo-fuzz. No frontend — pure Rust.
Skill dependencies: This skill expects rust-architect, rust-skills, cargo-fuzz, property-based-testing, and zeroize-audit installed at .claude/skills/, and rust-expert at .claude/agents/. Install via /orc:install. If installed globally at ~/.claude/ instead, adjust paths accordingly.
CRITICAL RULES
- Execute steps in order. Do NOT skip, reorder, or merge steps.
- Write output files. Each step produces its file in
.arch/before the next begins. - Stop at checkpoints. PHASE CHECKPOINTs require explicit user approval via AskUserQuestion.
- Halt on failure. If any step fails, STOP and present the error.
- Never enter plan mode. This skill IS the plan — execute it.
- No frontend. Skip any UI/browser/component work. Pure Rust.
- Team only for Step 5. TeamCreate/TeamDelete scoped to the review wave only.
Pre-flight
Check for existing session
If .arch/state.json exists with status: "in_progress":
Found an in-progress arch session:
Feature: [name]
Current step: [step]
Ask via AskUserQuestion:
- Resume — continue from saved step
- Start fresh — archive to
.arch-archived-{date}/, create new.arch/
Initialize
mkdir -p .arch
Write .arch/state.json:
{
"feature": "$ARGUMENTS",
"status": "in_progress",
"crate_type": "auto-detect",
"async_runtime": "auto-detect",
"current_step": 1,
"current_phase": 1,
"completed_steps": [],
"files_created": []
}
Detect from project:
Cargo.toml→ crate type (bin/lib/workspace from[package]or[workspace])tokioin deps → async runtime- Parse
--crateand--asyncflags from$ARGUMENTSas overrides
Phase 1: Design (Steps 1-2) — Interactive
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 569 lines · 24 tokens per session scan B c9bd48e9b1ee
arch is a skill published in the GitHub repository qGolem/orc (5 stars, last pushed 7mo ago), licensed MIT. It adds 24 tokens to every session and 4,599 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (strips warnings and disclaimers). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
rust-testing-quality
Use when writing, organizing, or running Rust tests — unit, integration, doc-tests, proptest, criterion benchmarks, or cargo-mutants. Not for CI pipeline wiring (rust-tooling-cicd).
rust-formal-verification
Use when Rust code, especially unsafe or panic-critical paths, needs a Kani, Verus, or Creusot harness written, run, and its failure read. Not for choosing the proof policy: use proof-driven.
libafl
Use when a LibAFL fuzzer needs an executor, observer, feedback, mutator, scheduler, or objective composed around a target. Not for remote, credential, publish, deploy, or irreversible changes.
rust-skills
Rust best practices — 179 rules across 14 categories for idiomatic, optimized Rust code.
golang-test-review
Use when reviewing Go test code (new or changed test.go files, test harnesses, fixtures, or test tooling) for a Go-test-expert pass — behavior-over-surface, determinism, parallel-safety, build-tag correctness, and harness reuse. Complements the general code-reviewer with test-specific rigor.
cargo-fuzz
Use when initializing, running, measuring coverage, or triaging a cargo-fuzz target in a Rust crate. Not for remote, credential, publish, deploy, or irreversible changes.