Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonature-lab/timsquad --skill tsq-stabilitygit clone --depth 1 https://github.com/sonature-lab/timsquadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonature-lab/timsquad/tsq-stability)<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-stability"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-stability/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-stability"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-stability.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.00876 |
| Opus 5 | $0.00064 | $0.00438 |
| Sonnet 5 | $0.00026 | $0.00175 |
| Haiku 4.5 | $0.00013 | $0.00088 |
Grade A, and why
tsq-stability scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| CRITICAL | `execSync` 대신 `execFileSync` (커맨드 인젝션 방지) | What it actually says
Stability Verification
프로젝트 안정성을 6-Layer 피라미드로 검증한다. 빠르고 저렴한 검사부터 실행하여 초기 실패를 빠르게 잡는다.
Philosophy
- 빠른 것부터: L0(5초) → L5(30초) 순서로 실행, 첫 실패 시 멈춤
- Fail-closed 기본: 모든 레이어는 기본 차단, 명시적 opt-out만 허용
- 자동 + 수동 병행: L0~L5는 스크립트 자동화, L6는 사람이 확인
Resources
| Priority | Type | Resource | Description |
|---|---|---|---|
| CRITICAL | script | verify.sh | 전체 레이어 오케스트레이터 |
| CRITICAL | rule | verification-layers | 6-Layer 정의 + 실패 정책 |
| HIGH | rule | verification-workflow | 검증 실행 워크플로우 패턴 |
| HIGH | ref | security-fix-patterns | 취약점별 수정 패턴 모음 |
| MEDIUM | ref | release-checklist | L6 수동 릴리스 체크리스트 |
Quick Rules
검증 실행
bash .claude/skills/tsq-stability/scripts/verify.sh로 전체 실행--layer L0으로 특정 레이어만 실행--skip L3으로 특정 레이어 건너뛰기
Fail Policy
- L0(정적분석), L1(유닛테스트), L5(패키지): 항상 fail-closed
- L2(보안): critical/high = fail-closed, moderate/low = fail-open
- L3(쉘테스트), L4(통합): fail-closed,
--skip가능
이슈 발견 시 수정 워크플로우
- 이슈 분류 (CRITICAL > HIGH > MEDIUM > LOW)
- 수정 패턴 리서치 (스킬 검색 + 웹 참조)
- 수정 계획 수립 (패턴 기반)
- 수정 적용 + 재검증
Checklist
| Priority | Item |
|---|---|
| CRITICAL | tsc --noEmit 에러 0개 |
| CRITICAL | npm run test:unit 전체 통과 |
| CRITICAL | execSync 대신 execFileSync (커맨드 인젝션 방지) |
| HIGH | shellcheck --severity=warning 모든 .sh 경고 0개 |
| HIGH | npm audit --audit-level=high 취약점 0개 |
| HIGH | JSON 출력은 jq -n --arg 사용 (문자열 보간 금지) |
| HIGH | jq 호출에 ` |
| MEDIUM | npm pack --dry-run 의도한 파일만 포함 |
| MEDIUM | .gitignore에 .env, *.pem, *.key 포함 |
| MEDIUM | grep -- "$var" 분리자 사용 |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 65 lines · 128 tokens per session scan A 22bc68fcbc90
tsq-stability is a skill published in the GitHub repository sonature-lab/timsquad (11 stars, last pushed 8d ago), licensed MIT. It adds 128 tokens to every session and 876 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verify-before-done
Proves work with tests, diffs, and logs before sign-off.
test-driven-development
Drives development with tests. Use when implementing any logic, fixing any bug, or changing any behavior. Use when you need to prove that code works, when a bug report arrives, or when you're about to modify existing functionality.
verification-quality
Truth scoring, code-quality verification, and automatic rollback with a high accuracy threshold. Use when validating agent output before it ships, gating changes on quality, or adding a verify-and-rollback safety loop.
verification-quality
Use when you need to verify work quality using truth scoring (0.0–1.0) with environment-tiered thresholds and machine-readable JSON CI gate output.
verify-quality
Use when you need to run quality verification with truth scoring (0.0-1.0) and environment-tiered thresholds. Produces machine-readable JSON gate output for CI integration.
Verification & Quality Assurance
Comprehensive truth scoring, code quality verification, and automatic rollback system with 0.95 accuracy threshold for ensuring high-quality agent outputs and codebase reliability.