Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sprngr/rubber-duck --skill duck-adventuregit clone --depth 1 https://github.com/sprngr/rubber-duckWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sprngr/rubber-duck/duck-adventure)<a href="https://agentmods.dev/skills/sprngr/rubber-duck/duck-adventure"><img src="https://agentmods.dev/badge/skills/sprngr/rubber-duck/duck-adventure/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sprngr/rubber-duck/duck-adventure"><img src="https://agentmods.dev/badge/skills/sprngr/rubber-duck/duck-adventure.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.01378 |
| Opus 5 | $0.00019 | $0.00689 |
| Sonnet 5 | $0.00008 | $0.00276 |
| Haiku 4.5 | $0.00004 | $0.00138 |
Grade A, and why
duck-adventure scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Standalone easter-egg rogue game 🦆🎲. Multi-turn dungeon crawls, dice combat, then exit. No work involved.
Purpose
Run a self-contained rogue RPG: multi-turn dungeon crawls with maps, dice combat, random merchants, loot, and achievements tracked across sessions. Fun for its own sake. No handoff to productivity flows.
Skill-specific delta:
- Opt-in only: game runs on explicit signal; if no signal, do not auto-inject into normal flows.
- Pure play: no productivity coupling, no handoff, no quack routing.
- Explicit exit: game ends when user says done/exit/quit. No implied return-to-work.
- Scripted engine: deterministic mechanics via
hooks/adventure.py; LLM narrates output. - State scope: writes only
.duck-adventure/state.json+state.md(+.gitignoreif missing). - One-time scope approval: game session approves state-file scope once at start; script writes state.json, LLM writes state.md summary at run end.
- Redaction: scan state content for secrets before any write; reject flagged content.
Activation
Explicit opt-in signals only: "duck adventure", "adventure mode", "chaos duck",
"quest mode", "play a game", "make it fun", /adventure. No signal = no game.
Do not auto-activate from inferred intent.
Method
1. Opt-in gate
Verify explicit signal. If absent, decline: no game. Continue normal flow.
2. State load + scope approval
Read .duck-adventure/state.json (schema v3, references/STATE_SCHEMA.md,
references/PARSER.md for verb surface) via python3 hooks/adventure.py resume.
If missing, request one-time execution approval for the state-file scope
(.duck-adventure/state.json + state.md + auto-created
.duck-adventure/.gitignore). Preflight: target files, expected = run +
permanent ledger, verification = adventure.py state. On approval, proceed.
Without approval, game runs
session-only or exits. Existing run in state: resume at saved floor/room/diagram.
Else: new run.
3. Run setup
New run: python3 hooks/adventure.py init (generates floor 1, player stats).
Resume: python3 hooks/adventure.py resume. Both return JSON state.
Name the quest from a assets/quests.md frame + category; record as
current_quest via python3 hooks/adventure.py save (script field; LLM
narrates the quest name).
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 121 lines · 38 tokens per session scan A d89c37455cc2
duck-adventure is a skill published in the GitHub repository sprngr/rubber-duck (8 stars, last pushed yesterday), licensed MIT. It adds 38 tokens to every session and 1,378 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
web-game-engine-expert
Expert guide for web-based game development. Covers Entity Component System (ECS) architectures, physics engines (Rapier, Havok, Cannon-es), collision detection, and game loop optimization.
roblox-studio
Build and edit in Roblox Studio via the Roblox Studio MCP the RIGHT way - preflight the Studio connection, do the whole build in a few big executeluau scripts (not dozens of tiny calls), make REALISTIC terrain with the Terrain VOXEL api driven by Perlin noise (NEVER stacked Parts or concentric layers - those give ugly…
avatar-contribution-pr
Turn an avatar GitHub issue (from the in-app avatar-editor easter egg) into a merged sprite — validate the art, then either add a new module or replace an existing one, and open a PR that closes the issue. Handles both "Avatar contribution: " (a brand-new sprite) and "Avatar edit: " (a hand-redraw of an existing…
threejs
Use when the user asks to build 3D web experiences with Three.js.
godot-devtool
Use when MCP clients and connected AI assistants work on a Godot 4 project through the godot-devtool 3.2.1 MCP server.
axiom-localization
Use when localizing apps, using String Catalogs, generating type-safe symbols (Xcode 26+), handling plurals, RTL layouts, locale-aware formatting, or migrating from .strings files - comprehensive i18n patterns for Xcode 15-26.