Borrowing it
Nothing to install: this file belongs to strikersam/autonomous-ai-agency. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/strikersam/autonomous-ai-agency/master/.claude/skills/drill/SKILL.mdgit clone --depth 1 https://github.com/strikersam/autonomous-ai-agencyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/strikersam/autonomous-ai-agency/drill)<a href="https://agentmods.dev/skills/strikersam/autonomous-ai-agency/drill"><img src="https://agentmods.dev/badge/skills/strikersam/autonomous-ai-agency/drill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/strikersam/autonomous-ai-agency/drill"><img src="https://agentmods.dev/badge/skills/strikersam/autonomous-ai-agency/drill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.02514 |
| Opus 5.5 | $0.00033 | $0.01006 |
| Sonnet 5.5 | $0.00017 | $0.00503 |
| Haiku 4.5 | $0.00008 | $0.00251 |
Grade A, and why
drill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/drill — clear the board, keep master green
Done means: every open PR is merged or closed with a reason, and every open issue is fixed, verified as already fixed, or closed with a reason. Master CI is green on its latest commit, no workflow's latest run on master is red, and a final report says which of these were checked. Nothing about it is a judgement call left in your head: each item ends in a merge, a close comment, or a line in the report that says why it is still open.
The drill is four phases. Work them in order and loop phases 2–3 until the inventory is empty. A merge moves master, which puts other PRs behind, and a long-running workflow can reopen an issue you just closed. So phase 4 always re-runs the inventory instead of trusting phase 1.
Phase 1 — Inventory (read-only)
git fetch origin master && git checkout -B <your-branch> origin/master
python scripts/drill_inventory.py # add --json for a machine-readable copy
The script lists every open PR and issue with its category, CI state on the PR
head, merge state, master CI, and every workflow whose latest run on master
failed. It never writes. A merge state of unknown means GitHub has not
computed it yet: query that PR again before acting on it.
Post the inventory table to the operator before changing anything. Then make a task per item; a long list goes into the task tracker, not your memory.
Phase 2 — Decide and implement, per category
Read the item before deciding: the body, the comments, and for a PR the diff
and the failing job's log (get_job_logs, tail ≈ 80 lines). The title and the
bot's own summary are claims, not evidence.
| Category | What to do |
|---|---|
own |
Your branch's PR (the script takes the checked-out branch, or --own-branch). Drive it through phase 3 like any fix. |
dependabot |
Check the new version exists on the registry. For a major bump, find the API we call (grep -rn "from <pkg>"), install the new version into a scratch dir (pip install --target <scratch> <pkg>==X) and run the tests that touch it with PYTHONPATH=<scratch>. A breaking change that affects us needs the operator (rule 40); none means it is safe to take. Branch protection requires PRs to be up to date, so each merge puts the rest behind. With more than three green bumps waiting, cherry-pick their commits into one PR from your branch and close the originals pointing at it. That is one CI round instead of one per bump. With fewer, PUT pulls/{n}/update-branch and merge them one at a time. Close a bump whose package another PR removes, saying which PR. |
agent (agent/*) |
Hold it to REVIEW.md. Close, with the reason, any PR that adds root-level report files, fabricated dates, retired model ids, removed tests or assertions, or a rewrite far larger than the plan. Otherwise fix it up on its branch and drive it like your own. |
automation (claude/daily-automation-*, claude/harness-scan-*, claude/context-issue-*) |
Daily model PRs follow .claude/skills/model-catalogue-update/SKILL.md. Resolve conflicts by merging master in, never by rebasing. A draft context PR whose issue closed should be closed too. A harness-scan draft is a report: merge it if it is docs-only and green, close it if superseded. |
session (claude/*) |
If the inventory marks it IN FLIGHT (pushed in the last 2 h), another session is likely still on it. Report it and leave it. Older than that, treat it as abandoned work and drive it to green. |
human |
Reviewers' small asks: implement. Larger asks or design questions: comment with a proposal and put the call to the operator. |
bug, automation-bug |
Reproduce or find the evidence first (failing run log, traceback). Check whether master already fixed it (git log -S, the latest scheduled run). If fixed, close with the commit and the green run as proof. If not, fix it with a regression test that fails first. |
quick-note, quick-note-rejected |
Read the linked source and the context PR. Build it if it is a real, scoped feature; otherwise close as not_planned and name what in the repo already covers it. |
routine |
Do each checkbox that is actionable from code. Close the issue when every box is done or has a written reason. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 163 lines · 83 tokens per session scan A 27b9a9c26c95
drill is a skill published in the GitHub repository strikersam/autonomous-ai-agency (11 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 2,514 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
audit-trail
Full traceability from PRD to code commit through the CCPM spec-driven pipeline.
github-sync
Bidirectional synchronization of epics and tasks with GitHub issues, labels, and relationships.
issue-tracking
Track beads as git-backed issues with persistent attribution, supporting Gas Town's bead lifecycle and convoy progress monitoring.
pr-shepherding
Monitor PR lifecycle from creation through merge including CI monitoring, review comment handling, thread resolution, and merge readiness verification.
agent-sync-coordinator
Agent skill for sync-coordinator - invoke with $agent-sync-coordinator.
pipeline-conductor
Operating procedure for the kirocrew-pipeline-conductor agent. Use when a pipeline conductor session is seeded, inspected or debugged. You MANAGE one issue/PR pipeline on one repo: two columns per item (session working? item solved?), send intent, never re-derive a red yourself.