Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sehoon787/my-codex --skill gstack-sprintgit clone --depth 1 https://github.com/sehoon787/my-codexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sehoon787/my-codex/gstack-sprint)<a href="https://agentmods.dev/skills/sehoon787/my-codex/gstack-sprint"><img src="https://agentmods.dev/badge/skills/sehoon787/my-codex/gstack-sprint/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sehoon787/my-codex/gstack-sprint"><img src="https://agentmods.dev/badge/skills/sehoon787/my-codex/gstack-sprint.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 123 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- medium Excessive Agency · line 137 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.02228 |
| Opus 5.5 | $0.00009 | $0.00891 |
| Sonnet 5.5 | $0.00004 | $0.00446 |
| Haiku 4.5 | $0.00002 | $0.00223 |
Grade A, and why
gstack-sprint scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- gstack-sprint — 91% identical, 34 lines differ
How it starts
The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<Use_When>
- End-to-end feature implementation ("build this feature", "design it and implement it")
- Build or Mid-sized intent type with implementation phase included
- User says "sprint", "end-to-end", "e2e implementation" </Use_When>
<Do_Not_Use_When>
- Pure design/planning/idea review without implementation → use /office-hours or /plan-ceo-review directly
- Architecture intent type (design only, no build)
- "just design it", "just plan it", "review my idea" — these route to /office-hours or /plan-ceo-review
- Single-purpose requests: code review → /review, QA → /qa, deploy → /ship
- Trivial fixes, research, documentation </Do_Not_Use_When>
<Why_This_Exists> End-to-end feature work fails silently in three predictable ways:
- Implementation starts before design is aligned — wrong thing built
- Execution proceeds without structured iteration — partial implementations declared done
- Review skips comparison against the design doc — drift goes unnoticed
gstack-sprint enforces the three-phase contract: user-confirmed design → automated execution via ralph → user-confirmed review against the design doc. Each phase boundary requires explicit user confirmation before the next phase begins. </Why_This_Exists>
Phase 1: Design (interactive — user decisions)
-
Determine scale from the user's request:
- Large (new feature, cross-system architecture, significant refactor) → invoke /plan-ceo-review first, then proceed to step 2
- Medium (scoped feature, single-service change) → skip /plan-ceo-review, proceed directly to step 2
-
Invoke /plan-eng-review (mandatory for all scales) to produce a structured engineering design document
-
Surface all key decisions using AskUserQuestion for each ambiguity:
- Technology choices with tradeoffs
- API contract decisions
- Data model decisions
- Scope boundary decisions
- Do not batch decisions silently — each decision that affects implementation requires explicit user input
-
Wait for user to confirm "design complete" before transitioning to Phase 2. Do not proceed to Phase 2 on your own judgment.
-
Skip condition: If the user's original message already confirms design is done ("design is done, just build it") → skip Phase 1 entirely and proceed to Phase 2 with the provided design context
-
Fallback (gstack not installed): Use the OMC planner agent (opus) to produce a structured plan. Present the plan to the user and wait for their confirmation before proceeding.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 186 lines · 22 tokens per session scan A 33c50cd98508
gstack-sprint is a skill published in the GitHub repository sehoon787/my-codex (29 stars, last pushed 2d ago), licensed MIT. It adds 22 tokens to every session and 2,228 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cas-delegate
A procedure for sending a clearly bounded task to another coding agent through a controlled delegation system. It covers checking permission, choosing an available agent, and handling refusal or failure.
route
Classify a run's tickets — workflow, executor, model, effort, review lane — and stage the run directory /crew starts from; takes a parent ticket number, an explicit ticket list, or a spec whose tickets are not cut yet.
assign
Assign a task to a specific role on your team.
standup
Quick project status report synthesized from state files, artifacts, and git activity. No agent dispatch (<2s).
add-member
Add a new team member. Describe what you need and ATeam infers the config.
status
Show the current state of a run — stages, roles, write locks, and gates.