Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add slbug/claude-ruby-grape-rails --skill request-state-auditgit clone --depth 1 https://github.com/slbug/claude-ruby-grape-railsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/slbug/claude-ruby-grape-rails/request-state-audit)<a href="https://agentmods.dev/skills/slbug/claude-ruby-grape-rails/request-state-audit"><img src="https://agentmods.dev/badge/skills/slbug/claude-ruby-grape-rails/request-state-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/slbug/claude-ruby-grape-rails/request-state-audit"><img src="https://agentmods.dev/badge/skills/slbug/claude-ruby-grape-rails/request-state-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Data Exfiltration · line 59 Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.Fix: Remove any code that sends prompts, responses, or session data externally. Preserve user privacy; never exfiltrate conversation content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01434 |
| Opus 5 | $0.00016 | $0.00717 |
| Sonnet 5 | $0.00007 | $0.00287 |
| Haiku 4.5 | $0.00003 | $0.00143 |
Grade A, and why
rb:state-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Request State Audit
Audit your Rails application for common state management issues that cause production bugs.
What This Audit Covers
| Category | Issues Detected |
|---|---|
| CurrentAttributes | Leakage across requests, missing resets, async flow contamination |
| Session/Cookie | Bloat, ActiveRecord objects stored, unbounded growth |
| Redis | Missing namespaces, keys without TTL, memory leaks |
| Turbo Streams | Double-work, broadcasts before commit, DB queries in streams |
| Data Integrity | Duplicated sources of truth, cache invalidation bugs |
When to Run
- Before major releases
- When adding new
Currentattributes - After switching to Turbo Streams
- When Redis memory usage grows unexpectedly
- After session-related bug reports
Audit Procedure
Step 1: CurrentAttributes Check
Modern Rails Behavior: CurrentAttributes automatically resets before and after each request. Manual reset middleware is not required for normal request flow.
Audit Focus: Jobs, threads, and async contexts where automatic reset does not apply.
Search for patterns:
- Use Grep: pattern
Current\., pathapp/jobsandapp/workers, glob*.rb - Use Grep: pattern
Thread\.new|Concurrent|Async|Fiber\.schedule, pathapp/, glob*.rb, context 5 — then check results forcurrentreferences
Verify:
- Jobs using
Currentexplicitly set context viaCurrent.setor pass values as args - Custom threads/fibers don't access
Currentwithout explicit context - External collaborators (Time.zone, etc.) registered via
resets { ... }if needed - Not over-stuffing controller-specific values into global Current
See: references/audit-procedures.md#currentattributes-usage
Step 2: Session Bloat Detection
Detect session store type first:
Use Grep: pattern config\.session_store, path config/initializers and config/application.rb.
For ActiveRecord session store: In rails console, run ActiveRecord::SessionStore::Session.pluck(:data).map { |d| d.to_s.bytesize }.max.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 162 lines · 33 tokens per session scan A 6f3e3e86886a
rb:state-audit is a skill published in the GitHub repository slbug/claude-ruby-grape-rails (7 stars, last pushed 8d ago), licensed MIT. It adds 33 tokens to every session and 1,434 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
api-errors
McpError constructor, JsonRpcErrorCode reference, and error handling patterns for @cyanheads/mcp-ts-core. Use when looking up error codes, understanding where errors should be thrown vs. caught, or using ErrorHandler.tryCatch in services.
footprint
Use when building flowchart pipelines with footprintjs — stage functions, decider branches, selectors, subflows, loops, narrative traces, recorders, redaction, contracts, and LLM-ready output. Also use when someone asks how footprint.js works or wants to understand the library.
error-handling-patterns
Master error handling patterns across languages including exceptions, Result types, error propagation, and graceful degradation to build resilient applications. Use when implementing error handling, designing APIs, or improving application reliability.
fastify-troubleshooting
This skill should be used when debugging Fastify issues, identifying Fastify anti-patterns, diagnosing common Fastify mistakes, performing Fastify error troubleshooting, investigating request.body undefined in hook, fixing decorator shared across requests, resolving hook executing twice, handling reply already sent…
drupal-debugging
Drupal debugging techniques — Devel module, Drush watchdog, Twig debug, XDebug, error logging, and common troubleshooting patterns.
a-unslop-code
Finds what makes source code read as AI-written and points you at the parts that actually ship bugs. Sorts every tell into three buckets and fixes them in that order: bugs (swallowed errors, a made-up API, a left-in "rest of the code" stub), substance (tutorial-shaped boilerplate, over-engineering, code that ignores…