Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SoliEstre/EstreGenesis --skill ultrasafe-social-engineergit clone --depth 1 https://github.com/SoliEstre/EstreGenesisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/soliestre/estregenesis/ultrasafe-social-engineer)<a href="https://agentmods.dev/skills/soliestre/estregenesis/ultrasafe-social-engineer"><img src="https://agentmods.dev/badge/skills/soliestre/estregenesis/ultrasafe-social-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/soliestre/estregenesis/ultrasafe-social-engineer"><img src="https://agentmods.dev/badge/skills/soliestre/estregenesis/ultrasafe-social-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 2 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00217 | $0.05960 |
| Opus 5 | $0.00109 | $0.02980 |
| Sonnet 5 | $0.00043 | $0.01192 |
| Haiku 4.5 | $0.00022 | $0.00596 |
Grade A, and why
ultrasafe-social-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 379 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Social Engineer — Ultrasafe Attacker Skill (Agent 5 / 8)
Role: Pre-release simulated penetration testing from the phishing surface / docs leak / OPSEC fail / human-factor attacker perspective. One of 7 attacker agents in the Ultrasafe 8-agent fan-out (Agents 1-7 = attackers, Agent 8 = synthesizer). Tone: human-factor-aware — describe findings in the language of human cognition (trust, authority, urgency, reciprocity) NOT raw CVE/CWE numbers alone. Translate every technical surface into "how would a human be tricked here?". Output: Findings emitted via
ULTRASAFE_FINDINGA2A intent (Constellation §13.16) — advisory mode in v0.2.x (report-only, NOT publish-blocking). Mandatory invariant: every finding carriesvalue.advisory: true+value.human_gate_required: true(LLM-classifier 기반 sensitive-topic 분류는 항상 human gate — auto-block 금지, Ultrasafe.md §2.1.5 cross-axis CT1 rule).
§1 When to invoke
Trigger conditions (ANY fires → activate):
- Orchestrator fan-out dispatch: orchestrator 역할 (메인 에이전트의 Workflow fan-out + MCP
ultrasafe_run_fanout— Ultrasafe.md §14.1 역할 매핑) 이 Phase A 의 7-attacker 병렬 dispatch 단계에서 본 skill 을 invoke (Ultrasafe.md §15.9). axis-set 에usf-social-eng포함 시 자동. - PreToolUse hook trigger: publish-equivalent command (
npm publish/pip upload/git push --tagsto public remote) 직전 hook (hooks/ultrasafe-trigger.cjs) 이 발화 + 활성 axis 에usf-social-eng포함 시. - Iteration ≥ 1 with prior_findings_set non-empty: secondary-surface 갱신 시 docs/A2A inbound 변화가 새 phishing surface 를 만들 수 있어 재dispatch (F_{N+1} = (F_N − sealed) + secondary_new 의 diff 추출).
- Manual operator invoke: 외부 disclosure intake (Constellation §13.16
SECURITY_DISCLOSURE_INTAKE) 가 docs/CHANGELOG/commit-message 영역 finding 을 reference 할 때 본 skill 로 재검증.
SKIP conditions:
- iteration = 0 (baseline 없음 — prior_findings_set 비교 불가).
- axis-set 에
usf-social-eng미포함. - Tier 1 patch (sensitivity 낮음, Ultrasafe.md §15.5 — Tier 2+ 에서 활성).
- target_commit_sha 가 직전 iteration 과 동일 + prior_findings_set 변동 0 (idempotent skip).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 379 lines · 217 tokens per session scan A e9d975d9c919
ultrasafe-social-engineer is a skill published in the GitHub repository SoliEstre/EstreGenesis (8 stars, last pushed 6d ago), licensed Apache-2.0. It adds 217 tokens to every session and 5,960 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
update-agent-context
This skill should be used to keep CLAUDE.md, AGENTS.md, and the skill files themselves compact, current, and internally consistent. It runs in three phases: Phase 1 performs a one-time structural refactor of CLAUDE.md using a Karpathy-inspired behavioral scaffold and derives AGENTS.md from it by stripping Claude…
watercooler-onboarding
Bootstrap Watercooler memory for a repository by inspecting local code, docs, CI, git history, and existing Watercooler threads, then writing a small set of durable, provenance-backed seed threads that future agents can query and extend. Use when entering a repo for the first time, seeding a repo with Watercooler…
search-threads
Search threads with filters. Supports filters like role:planner, type:Decision, after:2024-01, thread:topic-name, status:OPEN.
ppgp
Portable Persistent Goal Protocol for long-running coding-agent work. Use when starting, resuming, handing off, distilling, or closing a substantial software goal across long sessions, context compaction, agent replacement, or other Agent Skills-compatible coding-agent environments.
watercooler-health
Check watercooler system health — MCP server, baseline graph (T1), git auth, GitHub rate limit, and daemons. Use when syncs break or anything in the watercooler stack behaves unexpectedly.
recall
Recall project context or answer questions about history and decisions. Use before starting work, when investigating unfamiliar code, or asking "What was decided about X?" / "Why did we choose Y?".