Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add saeedkolivand/ai-job-hunter-app --skill automation-standardsgit clone --depth 1 https://github.com/saeedkolivand/ai-job-hunter-appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/saeedkolivand/ai-job-hunter-app/automation-standards)<a href="https://agentmods.dev/skills/saeedkolivand/ai-job-hunter-app/automation-standards"><img src="https://agentmods.dev/badge/skills/saeedkolivand/ai-job-hunter-app/automation-standards/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/saeedkolivand/ai-job-hunter-app/automation-standards"><img src="https://agentmods.dev/badge/skills/saeedkolivand/ai-job-hunter-app/automation-standards.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01350 |
| Opus 5 | $0.00033 | $0.00675 |
| Sonnet 5 | $0.00013 | $0.00270 |
| Haiku 4.5 | $0.00007 | $0.00135 |
Grade A, and why
automation-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Automation standards (scraping + AI-provider)
Authoritative: docs/knowledge/automation-domain.md.
Scraping
- Register via the registry —
scraping/boards/mod.rs(SCRAPERS,Scrapertrait,ScraperModeHttp/Browser). Don't special-case boards outside the registry. - Selector resilience — core boards need fallback selectors; a brittle single-selector parse on a core board is HIGH.
- Reliability — honor the cancellation token in
ScrapeContext; bounded retries with backoff; per-board rate limits; graceful failure recovery (don't poison the queue). - Sessions/cookies — handled safely; never log credentials/cookies (security lens →
tauri-security-reviewer).
AI provider (the architectural rule — HIGH if violated)
- No business logic depends on provider-specific APIs. All providers implement a shared interface; adding OpenAI/Anthropic/Gemini/Ollama/OpenRouter/LM Studio = config + adapter only.
- Embeddings — versioned; on model/space change, invalidation must run (stale embeddings are HIGH).
- Streaming — partial responses + cancellation handled; no leaks on cancel.
- Prompts (
packages/prompts) — provider-aware + locale-driven, pure TS, zero deps; reusable/composable templates. - Cost — minimize token/context; pick the cheapest viable model.
External standards & best-practices (verified 2026-06-19)
AI / LLM (cross-provider — Claude specifics live in the claude-api skill)
- OWASP Top 10 for LLM Apps (2025) — https://genai.owasp.org/llm-top-10/
- LLM01 Prompt Injection (direct + indirect) — segregate/label untrusted external content (scraped JD/résumé text is untrusted; never concatenate raw into the instruction block); constrain model role; deterministically validate output; least-privilege tool tokens; human-in-the-loop on high-risk actions. No fool-proof fix → layer defenses.
- LLM05 Improper Output Handling — treat output as untrusted; parse/validate (Zod/serde) before it reaches IPC/files/render; never
eval/shell/SQL with raw output. - LLM02 Sensitive-Info Disclosure + LLM07 System-Prompt Leakage — strip PII/secrets from prompts + logs; no secrets in system prompts. LLM06 Excessive Agency — minimal tools/permissions; gate side-effects behind user confirmation.
- Structured output — prefer native tool/function-calling with constrained decoding over free-text JSON; schemas guarantee shape, not values — still validate.
- Streaming — SSE is the cross-provider standard; handle partial/aborted streams, disable proxy buffering, support cancellation, prefer partial+error over silent regen.
- Retries/idempotency — backoff + jitter; retry only idempotent reads; idempotency key/ledger for mutating tool calls.
- Cost/caching — static prefix first (system prompt + tool schemas) to maximize prompt-cache hits; instrument hit-rate.
- Evals — version prompts; rerun a fixed eval set on every prompt/model/provider change (2026 models ship faster than your releases and silently shift behavior).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 50 lines · 66 tokens per session scan A 8f4d8677067f
automation-standards is a skill published in the GitHub repository saeedkolivand/ai-job-hunter-app (55 stars, last pushed yesterday), licensed Apache-2.0. It adds 66 tokens to every session and 1,350 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
anarlog
Query Anarlog meetings, notes, summaries, transcripts, participants, action items, and recurring history. Use when a user asks about their Anarlog meeting data or needs meeting context for another task.
django-migrations
Django migration patterns and safety workflow for PostHog. Use when creating, adjusting, or reviewing Django/Postgres migrations, including non-blocking index/constraint changes, multi-phase schema changes, data backfills, migration conflict rebasing, and product model moves that require SeparateDatabaseAndState. Also…
prompt-cache-optimizer
Audit and optimize Pisper system-prompt and tool-schema token overhead while preserving stable prompt-cache prefixes, permissions, and runtime behavior. Invoke only for explicit prompt or tool-context optimization work.
WRITE_ATTACHMENT_SERVICE
You are adding an inbound/attachment module to a domain crate. This module implements the attachment::AttachmentService trait so the crate can resolve its entity IDs into AI-consumable attachment content.
webiny-api-cms-content-models
Creating Headless CMS content models via code using the ModelFactory pattern. Use this skill when the developer wants to create, modify, or understand content model definitions, define fields and validators, set up reference fields between models, configure field layouts (including nested layouts inside object or…
webiny-form-model
Building forms with the FormModel system — field types, renderers, layout, validation, conditional rules, computed fields, and dynamic zones. Use this skill when the developer needs to define form fields with the builder API, choose renderers, build layouts with tabs/rows/separators, add validation (Zod or…