Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seqra/opentaint --skill create-test-projectgit clone --depth 1 https://github.com/seqra/opentaintWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seqra/opentaint/create-test-project)<a href="https://agentmods.dev/skills/seqra/opentaint/create-test-project"><img src="https://agentmods.dev/badge/skills/seqra/opentaint/create-test-project/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seqra/opentaint/create-test-project"><img src="https://agentmods.dev/badge/skills/seqra/opentaint/create-test-project.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.02128 |
| Opus 5.5 | $0.00014 | $0.00851 |
| Sonnet 5.5 | $0.00007 | $0.00426 |
| Haiku 4.5 | $0.00004 | $0.00213 |
Grade A, and why
create-test-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Create Test Project
Build a minimal compiled test project whose samples reproduce the flow a rule or approximation is verified against. A sample routes data between a real library method and the generic taint marker the scaffold provides, with the one verdict it must produce — a positive that must flag, a negative that must not. The compiled model is the deliverable; its sample sources sit alongside it.
Inputs
Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default
project-root(optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed<project-root>/.opentaint/directory, so every.opentaint/...path below resolves there. Default: current directorylanguage(required) — target language for this project and language-specific instructionstype(required) — what this project verifies, selecting the sample style and the identifying inputs below:rule-source,rule-sink, ordataflow- for
rule-source/rule-sink—unit: the unit id; its members anddependenciescome from.opentaint/tracking/rules/sources|sinks/<unit>.yaml - for
dataflow—batch: the batch whose.opentaint/tracking/approximations/<batch>.yamlprovides the dataflow methods to exercise and theirdependencies
The project folder <name> is that identifier — the unit for a rule side, the batch for a dataflow approximation.
Workflow
1. Scaffold the project
The scaffold command and sample form are language-specific — read the reference for your type: references/<lang>-rule.md for rule-source / rule-sink, or references/<lang>-approximation.md for dataflow (one self-contained reference, no need to read the other). Scaffold the project for the type, passing each of the unit's dependencies at its pinned version. The scaffold provides the generic taint marker and the fixed test rule the samples run against, so you author only the samples. If the <name> project already exists — re-invoked because its surface grew or a dependency moved — extend it instead: add the missing samples and recompile rather than scaffolding fresh. The init command is in that reference.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +5 lines 56f2bf055fac
- 1mo ago First seen · 131 lines · 36 tokens per session scan A 7a94d7a7ef07
create-test-project is a skill published in the GitHub repository seqra/opentaint (164 stars, last pushed today), licensed Apache-2.0. It adds 36 tokens to every session and 2,128 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
coding-guard
Compact coding guidelines for the explyt/spring-plugin repository - covers process rules (think first, simplicity, surgical changes), module layout, IntelliJ Platform threading and PSI rules, inspection and test conventions, message bundles, statistics tracking, and PR hygiene. You must call this skill before any code…
review-core-correctness
Normative mandatory reviewer for correctness, contracts, architecture sanity, UX behavior, code quality and tests in the explyt spring-plugin codebase. Use during orchestrated code review of a PR, diff, commit or branch, or when asked to review correctness, logic, architecture or test coverage of plugin changes.
develop-gutter-navigation-feature
End-to-end workflow for adding or repairing a navigation gutter / line marker in the explyt/spring-plugin repository: the two independent provider entry points, the lazy-targets contract of NavigationGutterIconBuilder, module resolution and search scope for library PSI, honest empty-state wording, target renderers for…
review-statistic-coverage
Usage-statistics coverage check for explyt/spring-plugin code reviews — verify that new user-visible features (quick fixes, intentions, gutter actions, completions, actions, tool-window controls, wizard steps) register usage via StatisticService and StatisticActionId. Use when reviewing a diff or PR that adds or…
review-context-builder
Builds reusable context for reviewer subskills: architecture, dependencies, tests, conventions, freeze-safety hot paths, and risks. Use during an orchestrated code review after scope resolution, when asked to build review context, map affected modules, or inventory freeze-safety hot paths before a review wave.
spring-mcp-contracts
Develops and verifies JSON contracts of the Spring plugin's MCP tools using Java/Kotlin PSI, UAST, scoped Spring models and bounded response regression tests. Use when changing an endpoint lookup or contract tool, URL matching, the call-chain trace, a bean lookup or listing tool, a parameter source or requiredness, a…