Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ramboz/jig/contractsnpx skills add ramboz/jig --skill contractsgit clone --depth 1 https://github.com/ramboz/jigWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ramboz/jig/contracts)<a href="https://agentmods.dev/skills/ramboz/jig/contracts"><img src="https://agentmods.dev/badge/skills/ramboz/jig/contracts.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00163 | $0.03394 |
| Opus 5 | $0.00081 | $0.01697 |
| Sonnet 5 | $0.00033 | $0.00679 |
| Haiku 4.5 | $0.00016 | $0.00339 |
Grade A, and why
contracts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spec 022 promoted this skill from a deliberate stub (ADR-0002) to jig's team baseline for external-interface contract artifacts, following the reframing in ADR-0005. Like
/jig:pr-review(spec 012),/jig:arch-review(spec 014), and/jig:vision-elicitation(spec 017), it ships as SKILL.md only — no.pyhelper. The skill recommends the canonical industry-standard schema per external surface and points at the ecosystem tools that validate it. It does not write schemas, not scaffold acontracts/directory, and not enforce contracts via PreToolUse hooks. Enforcement is structural via the spec-author's first-pass attention and the independent-review reviewer prompt's second-pass check — both wired in slice 022-02.
What this skill does
For each external surface a project exposes (HTTP API, event bus, RPC, GraphQL, internal data shapes, CLI output, config), this skill recommends:
- The canonical artifact — what to put on disk (e.g.,
openapi.yaml,*.schema.json,*.proto,schema.graphql). - The validation tool — what runs in CI to keep code and artifact
in sync (e.g.,
spectral lint,ajv validate,buf lint,graphql-inspector diff). - The codegen tool — what produces typed clients / server stubs /
TS types from the artifact, when ecosystem-appropriate (e.g.,
openapi-typescript,quicktype,buf generate).
The skill is breadth over depth: catch the right artifact per surface, leave language-specific niceties (Zod vs JSON Schema vs Pydantic vs TypeBox for internal shapes) to a richer user-installed contracts skill or to the dev's judgment. The recommendations are a nudge; the dev decides whether to follow them.
When to use vs. when to defer
- Any other installed contracts skill. Common location:
~/.claude/skills/contracts/— but the deferral is category-based, not name-based, so a skill named anything (contracts,schema-design,contract-first,api-contracts, etc.) whose description claims external-interface contract artifacts, API schema design, or contract-first workflow will be preferred. If one is present, defer to it. The Claude Code skill router should route to the more specific skill automatically; if you want to be sure, explicitly invoke it. /jig:arch-review— sibling jig skill that reviews the design of an API surface (the proposal, the trade-offs, the failure modes). This skill is downstream: once the design is locked, formalize the resulting interface as a contract artifact. Reach for/jig:arch-reviewto debate whether the API should exist; reach for this skill once it does./jig:adr-workflow— if the dev decides to systematically opt out of the canonical recommendation for a surface (e.g., "we'll keep our bespoke env-contract checker, not migrate to a JSON Schema + ajv triple"), capture the rationale in an ADR. This skill nudges; ADRs document the choice when the nudge is declined.- The deferred ADR-0002 stub concept (internal module-boundary enforcement, cross-module Python imports, kitchen-sink scaffolding). Not this skill. ADR-0002 stays in force for the internal-boundary problem; ADR-0005 carved out external-interface artifacts as the separate concern this skill addresses.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 237 lines · 163 tokens per session scan A c6747322cb3f
contracts is a skill published in the GitHub repository ramboz/jig (6 stars, last pushed 3d ago), licensed MIT. It adds 163 tokens to every session and 3,394 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
motherduck-build-cfa-app
Design a MotherDuck-backed customer-facing analytics app. Use for embedded analytics, multi-tenant SaaS reporting, or product analytics for external users -- whenever the decision depends on per-customer isolation, backend routing, service-account boundaries, read scaling, or Hypertenancy-style patterns.
motherduck-build-dashboard
Build a live MotherDuck dashboard as a Dive. Use when composing one shareable KPI, trend, and breakdown story over existing MotherDuck data, especially when the result should stay a saved workspace artifact rather than a full application.
motherduck-build-data-pipeline
Design an end-to-end MotherDuck data pipeline. Use for ETL/ELT workflows -- choosing raw, staging, and analytics boundaries, bulk ingestion paths, transformation sequencing, dlt/dbt integration, publication targets, or whether DuckLake is actually required.
motherduck-connect
Connect to MotherDuck from any application. Use when setting up database connectivity via the Postgres endpoint (recommended), pgduckdb, native DuckDB API, or JDBC. Covers connection strings, authentication, SSL, and environment variable configuration.
motherduck-create-dive
Create, edit, manage, share, or embed MotherDuck Dives — live React + SQL dashboards, charts, and data apps saved in the workspace. Use for any dashboard, chart, KPI display, or data visualization over MotherDuck data, and for Dive authoring mechanics such as getdiveguide, useSQLQuery, local preview, version history…
motherduck-create-flight
Create, schedule, run, and debug MotherDuck Flights — Python jobs that run on MotherDuck compute. Use whenever someone wants to create a flight, schedule a Python script or recurring job on MotherDuck, set up scheduled ingestion from Postgres, dlt sources, S3, BigQuery, Snowflake, or APIs, refresh aggregates or…