Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/statsclaw/statsclaw/attributionnpx skills add statsclaw/statsclaw --skill attributiongit clone --depth 1 https://github.com/statsclaw/statsclawWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00017 | $0.00495 |
| Opus 5 | $0.00009 | $0.00247 |
| Sonnet 5 | $0.00003 | $0.00099 |
| Haiku 4.5 | $0.00002 | $0.00049 |
Grade A, and why
attribution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Shared Skill: Attribution — Commit Authorship Policy
StatsClaw commits are attributed to the user alone. Shipper MUST NOT append any co-author trailer, tooling footer, or bot attribution to commit messages.
Policy
Every commit produced by shipper — in the target repo, the workspace repo, or any brain-seedbank fork — uses a clean message with no trailers of the following forms:
Co-authored-by: StatsClaw <[email protected]>Co-authored-by: Claude <[email protected]>(or any otherCo-authored-by:line)Generated with Claude Codefooterhttps://claude.ai/code/session_...URL- Any other tool-attribution line
The git author and committer are the user, as determined by their local user.name / user.email config. Shipper does NOT pass --author, set GIT_AUTHOR_* / GIT_COMMITTER_*, or configure a bot identity.
Rationale
- The user is the only person responsible for the change.
- GitHub's contributor list is driven by commit author/committer +
Co-authored-bytrailers. Adding bot trailers pollutes the contributor graph (e.g.,StatsClaw-Shipper,Claude). - Tooling footers leak session identifiers and add noise to
git log.
Scope
- Applies to: every commit shipper creates — target repo, workspace repo, brain-seedbank fork.
- Applies to: every commit any other agent makes locally inside its worktree (builder, scriber, simulator) — these commits are squashed/merged back, but their messages should also be clean.
- Does not apply to: PR titles or bodies, issue comments, or any non-commit artifact (those may reference StatsClaw or the workflow when useful).
Enforcement
If shipper (or any other agent) emits a commit with a forbidden trailer, reviewer flags it as a STOP. The fix is to amend or reword the commit before pushing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 46 lines · 17 tokens per session scan A f1b671157eff
attribution is a skill published in the GitHub repository statsclaw/statsclaw (91 stars, last pushed 1mo ago), licensed MIT. It adds 17 tokens to every session and 495 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audit-reproducibility
Enforce the replication-protocol.md rule by cross-checking numeric claims in a manuscript against the actual R / Stata / Python outputs. Report PASS/FAIL per claim against tolerance thresholds. Use before submission and before releasing a replication package.
diagnose
Root-cause a failing or wrong empirical result with a disciplined reproduce → minimise → hypothesise → instrument → fix loop, instead of guessing-and-poking. Use when the user says "why is my regression wrong", "this number changed", "my script errors out", "the result won't reproduce", "debug this", "this estimate…
capture-environment
Snapshot the computational environment for a replication package — detects the analysis stack (R / Stata / Python) and emits the right lockfiles (renv.lock + sessionInfo.txt, requirements.txt / environment.yml / uv.lock, Stata version + ado package list), records seeds and RNG kind, optionally writes a pinning…
checkpoint
Save a structured state snapshot before stopping or handing off. Captures the active plan, recent decisions, file pointers (with line numbers), open questions, and the next 1–3 actions into a checkpoint file under qualityreports/checkpoints/. Optionally proposes [LEARN] entries to add to MEMORY.md. Use when user says…
coauthor-brief
Generate a co-author / collaborator handoff brief for a multi-author, multi-machine project — summarizing what changed since the last brief (git delta), the current state of each artifact (manuscript, analysis, slides), open questions, how to reproduce locally, and any restricted-data access steps. Use when user says…
data-management-plan
Draft a funder-compliant Data Management Plan (NSF DMP, NIH DMS Policy 2023, ERC, Horizon Europe) by composing the confidential-data and environment-capture primitives. Sections cover data description, formats/metadata, storage/backup, access/sharing, preservation/archiving, and roles. Use when user says "data…