Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add snapsynapse/skill-provenance --skill bootstrapgit clone --depth 1 https://github.com/snapsynapse/skill-provenanceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snapsynapse/skill-provenance/bootstrap)<a href="https://agentmods.dev/skills/snapsynapse/skill-provenance/bootstrap"><img src="https://agentmods.dev/badge/skills/snapsynapse/skill-provenance/bootstrap/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/snapsynapse/skill-provenance/bootstrap"><img src="https://agentmods.dev/badge/skills/snapsynapse/skill-provenance/bootstrap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 30 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.01084 |
| Opus 5.5 | $0.00036 | $0.00434 |
| Sonnet 5.5 | $0.00018 | $0.00217 |
| Haiku 4.5 | $0.00009 | $0.00108 |
Grade A, and why
bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Provenance: Bootstrap
Add provenance tracking to an existing unversioned skill bundle. This is a one-time operation that creates the initial manifest, version headers, and changelog.
When to use
Run /skill-provenance:bootstrap when you have a skill directory that
contains a SKILL.md but lacks MANIFEST.yaml. This is the entry point
for adopting Skill Provenance on an existing project.
If the bundle already has a MANIFEST.yaml, use /skill-provenance:open
instead.
Protocol
-
Inventory all files. Read the directory structure yourself — do not ask the user to list files. Identify:
SKILL.md(required — if missing, this isn't a skill bundle)- Evals files (e.g.,
evals.json) - Scripts (e.g.,
generate.js,validate.sh) - Output artifacts (
.docx,.pdf) - Source material provided by the user
- Any other files present
-
Propose version numbers. Ask the user what version to assign. If there's a handoff note, git history, or other context suggesting prior versions, propose a number based on that history. Default to
1.0.0for the bundle and1for individual files if no history exists. -
Add internal version headers to files that can safely carry YAML frontmatter. Use the
metadatablock pattern for SKILL.md:--- name: skill-name description: What the skill does. metadata: skill_bundle: skill-name file_role: skill version: 1 version_date: 2026-04-11 previous_version: null change_summary: Initial versioned release. ---For files that cannot safely carry frontmatter (
.json,.sh, binaries), the manifest tracks their version — no modification needed. -
Determine frontmatter mode. Maintain the canonical source in
frontmatter_mode: metadatawhen richer provenance is useful. For Codex, Gemini CLI, or another strict loader, derive a minimal-frontmatter install copy rather than weakening the canonical source in place. If the user explicitly wants one strict-only bundle,minimalis valid.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 119 lines · 91 tokens per session scan A f58012b0cc7b
bootstrap is a skill published in the GitHub repository snapsynapse/skill-provenance (7 stars, last pushed 1mo ago), licensed MIT. It adds 91 tokens to every session and 1,084 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prompt-master
Generates optimized prompts for AI tools. Activates only when the user explicitly asks to write, fix, improve, or adapt a prompt for a specific AI tool (LLM, Cursor, Midjourney, image AI, video AI, coding agents, etc.). Does not activate for general conversation, coding tasks, document writing, or other…
dividend-analysis
Comprehensive capital allocation analysis: dividends, buybacks, M&A, debt management, and FCF deployment.
cocotrace
Build and query the SHA-256 requirements-to-implementation traceability graph across lifecycle artifacts.
competitor-analysis
Deep competitive moat analysis, market position assessment, and industry dynamics for one company against its direct rivals. To map an industry's supply / value chain and find chokepoints, use industry-map.
position-ladder
Plan a staged position — entry ladder, share-count floor/ceiling, and the trim/re-add cycle that lowers average cost — with lot accounting, wash-sale checks, total-return honesty, and a thesis-break exit gate.
sector-analysis
Analyze US market sectors and identify rotation opportunities.