Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rootbr/rooted --skill software-craftgit clone --depth 1 https://github.com/rootbr/rootedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rootbr/rooted/software-craft)<a href="https://agentmods.dev/skills/rootbr/rooted/software-craft"><img src="https://agentmods.dev/badge/skills/rootbr/rooted/software-craft/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rootbr/rooted/software-craft"><img src="https://agentmods.dev/badge/skills/rootbr/rooted/software-craft.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.06653 |
| Opus 5.5 | $0.00038 | $0.02661 |
| Sonnet 5.5 | $0.00019 | $0.01331 |
| Haiku 4.5 | $0.00010 | $0.00665 |
Grade A, and why
software-craft scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 259 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Software Craft
You orchestrate a build and its craft review, or a craft review alone, and deliver verified findings. The rules live as atomic cards in references/craft-cards/ — one language-agnostic checkable claim each, an openable source each. A developer agent writes code by those cards: before each step it lists the cards for that step by facet and reads the ones whose titles apply. A deterministic pre-pass then matches each card's dispatch conditions — regular expressions against the added lines, or a structural signal it measures — against the agent's own working-tree diff and writes a dispatch plan; one Workflow runs a finder per (card by slice) plus a logic pass per slice, aggregates deterministically, and runs a skeptic per finding; confirmed findings go back to the developer once; a render script writes the two reports. Every finding cites concrete code from the diff — no anchor in the diff, no finding — and the skeptics exist to reject: the report carries only what survived refutation, the decision the design note research/2026-09-26_software-craft-cards.md at the repository root records.
Quick rules:
- One confirmation with the user, at the end of Scope; ask further questions only when every context source is empty or no base branch resolves.
- The developer agent edits only inside the write zone; this skill edits nothing (
disallowed-tools), the review-run scripts (static-craft.py,bundle-run.py,render-reports.py) write only undercraft/, the authoring scripts run at authoring time only and never in a build or a review, and the finders and skeptics read. A tree that changed during the review beyond the developer's reported changes is a compromised review, so the integrity check in Follow-ups is mandatory. - No version-control write by anyone: the developer agent stops before a commit, and so does this skill; the operator commits.
- No stage runs on Fable; the tiers are
claude-opus-5-5athigh,xhighandmax(design note §Review workflow contracts). - The plan is never retyped:
scripts/bundle-run.pyembeds it, and the Workflow call namescraft/run.js. - Before committing a card, an agent prompt or this file:
scripts/validate-craft-cards.pyon the corpus, then the audit (repository Quality Gate).
Phases: Scope → Context → Build → Pre-pass → Workflow → Fix round → Follow-ups and report. A review-only run skips Build and the Fix round.
Runtime layout under the target repository's craft/ (or the config-set report path for the two reports):
craft/
|-- plan.json # pre-pass output: inventory with signals, card index, jobs, slices, candidates, project cards
|-- plan.log # every skip, merge, split and drop the pre-pass performed
|-- run.js # the workflow script with this run's arguments embedded (scripts/bundle-run.py)
|-- findings.json # aggregated findings after the find stage (the cross-session checkpoint)
|-- raw-<i>.json # the raw findings of find part i (a run in parts)
|-- verdicts.json # findings with verdicts (and rulings) after the verify stage
|-- build-report.md # the developer agent's report (build runs)
|-- craft-review-<task>.md # deliverable 1
`-- craft-review-<task>-rejections.md # deliverable 2
Paths below are relative to this skill's directory unless they start with craft/ (the target repository) or plugins/.
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 6.1 KB
- evals/expected.json 15 KB
- evals/fixture/base/change/java/Order.java 332 B
- evals/fixture/base/change/ts/codec.ts 275 B runs code
- evals/fixture/base/change/ts/plugins.ts 74 B runs code
- evals/fixture/base/code/go/stock_http.go 191 B
- evals/fixture/base/code/go/stockroom.go 908 B
- evals/fixture/base/code/java/InvoiceLedger.java 1.0 KB
- evals/fixture/base/code/java/ShipmentPlanner.java 748 B
- evals/fixture/base/code/rust/billing.rs 616 B
- evals/fixture/base/code/rust/session_cache.rs 654 B
- evals/fixture/base/design/java/Shape.java 164 B
- evals/fixture/base/errors/go/catalog.go 977 B
- evals/fixture/base/errors/go/inventory.go 1.2 KB
- evals/fixture/base/errors/py/ledger.py 588 B runs code
- evals/fixture/base/errors/py/profiles.py 363 B runs code
- evals/fixture/base/errors/ts/orders.ts 378 B runs code
- evals/fixture/base/errors/ts/pricing.ts 588 B runs code
- evals/fixture/base/performance/ts/parser.ts 310 B runs code
- evals/fixture/base/tests/java/shop/CachedPriceList.java 560 B
- evals/fixture/base/tests/java/shop/DeliveryEstimator.java 191 B
- evals/fixture/base/tests/java/shop/InventoryGateway.java 239 B
- evals/fixture/base/tests/java/shop/JdbcInventoryGateway.java 1.9 KB
- evals/fixture/base/tests/java/shop/Mailer.java 145 B
- evals/fixture/base/tests/java/shop/Money.java 572 B
- evals/fixture/base/tests/java/shop/Order.java 140 B
- evals/fixture/base/tests/java/shop/OrderRepository.java 205 B
- evals/fixture/base/tests/java/shop/OrderService.java 755 B
- evals/fixture/base/tests/java/shop/OrderServiceTest.java 793 B
- evals/fixture/base/tests/java/shop/PriceList.java 175 B
- evals/fixture/base/tests/java/shop/Quote.java 162 B
- evals/fixture/base/tests/java/shop/QuoteService.java 421 B
- evals/fixture/base/tests/java/shop/QuoteServiceTest.java 448 B
- evals/fixture/base/tests/java/shop/Reservation.java 269 B
- evals/fixture/base/tests/java/shop/ReservationService.java 890 B
- evals/fixture/base/tests/python/checkout.py 1.2 KB runs code
- evals/fixture/base/tests/python/profiles.py 1.5 KB runs code
- evals/fixture/base/tests/python/release_notes.py 569 B runs code
- evals/fixture/base/tests/python/requirements.txt 28 B
- evals/fixture/base/tests/python/test_markdown_renderer_integration.py 203 B runs code
- evals/fixture/base/tests/python/test_profiles.py 306 B runs code
- evals/fixture/base/tests/python/test_welcome_flow.py 387 B runs code
- evals/fixture/base/tests/python/welcome_flow.py 1.1 KB runs code
- evals/fixture/base/tests/ts/checkout.test.ts 291 B runs code
- evals/fixture/base/tests/ts/checkout.ts 540 B runs code
- evals/fixture/base/tests/ts/clock.ts 132 B runs code
- evals/fixture/base/tests/ts/discount-rules.ts 268 B runs code
- evals/fixture/base/tests/ts/invoice.ts 952 B runs code
- evals/fixture/base/tests/ts/order-repository.ts 1.5 KB runs code
- evals/fixture/base/tests/ts/package.json 402 B
- evals/fixture/base/tests/ts/session-store.ts 1.3 KB runs code
- evals/fixture/base/tests/ts/shipping.test.ts 289 B runs code
- evals/fixture/base/tests/ts/shipping.ts 1010 B runs code
- evals/fixture/base/tooling/rust/Cargo.toml 135 B
- evals/fixture/head/change/go/writer.go 590 B
- evals/fixture/head/change/java/Order.java 332 B
- evals/fixture/head/change/java/Pricing.java 407 B
- evals/fixture/head/change/ts/codec.ts 275 B runs code
- evals/fixture/head/change/ts/plugins.ts 74 B runs code
- evals/fixture/head/change/ts/reader.ts 93 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 259 lines · 96 tokens per session scan A 4e9105c0ef92
software-craft is a skill published in the GitHub repository rootbr/rooted (21 stars, last pushed 2d ago), licensed Apache-2.0. It adds 96 tokens to every session and 6,653 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.
Other skills, from other repositories
adk-go-self-review
Review an ADK Go change the way a maintainer will — a fresh-context pass over the whole diff, five lenses (correctness and tests, scope, simplicity, style, adk-python parity), and the mutation check that proves your tests pin the change. Use before opening a PR, before any later push that changes code, and when asked…
adversarial-reviewer
Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart. Do not use for ordinary review, style feedback, or general improvement suggestions.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
plugin-review
Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.