Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add synaptiai/synapti-marketplace --skill engagement-scopinggit clone --depth 1 https://github.com/synaptiai/synapti-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/synaptiai/synapti-marketplace/engagement-scoping)<a href="https://agentmods.dev/skills/synaptiai/synapti-marketplace/engagement-scoping"><img src="https://agentmods.dev/badge/skills/synaptiai/synapti-marketplace/engagement-scoping/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/synaptiai/synapti-marketplace/engagement-scoping"><img src="https://agentmods.dev/badge/skills/synaptiai/synapti-marketplace/engagement-scoping.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00135 | $0.02012 |
| Opus 5 | $0.00068 | $0.01006 |
| Sonnet 5 | $0.00027 | $0.00402 |
| Haiku 4.5 | $0.00014 | $0.00201 |
Grade A, and why
engagement-scoping scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Engagement Scoping
Phase 0 of every dossier run. Establishes what this run is, what it may touch, and what it may do — before it reads a single source file.
Iron Law
RESOLVE SCOPE BEFORE READING ANYTHING. The action ceiling and the file set are fixed in Phase 0 and never widen mid-run.
A run that discovers a reason to read one more directory, execute one more command, or write one more file has stopped being auditable. Record the need as an AQ-#### row and finish inside the ceiling you started with.
Resolution order
Every value comes from bin/dossier-resolve-config.sh, never from reading a settings file directly — reading one directly skips four layers of the cascade. See references/config-resolution.md.
OUTPUT_ROOT=$(bin/dossier-resolve-config.sh --default "docs/dossier" dossier.project.outputRoot)
MODE=$(bin/dossier-resolve-config.sh --default "full" dossier.engagement.deliveryMode)
bin/dossier-validate-config.sh || echo "config findings above must be resolved before drafting"
Validate before scoping. A config that fails dossier-validate-config.sh produces a package whose containment guarantees do not hold, and finding that out in Phase 5 wastes the whole run.
The twelve inputs
| Input | Config key | When absent |
|---|---|---|
| Project name | project.name |
Blocking in full/targeted. Ask — never infer, because an inferred product name propagates into public documents |
| Mission | project.mission |
Record U. Derive what evidence supports; never invent intent |
| Sources | project.sources |
Blocking in full/targeted |
| Output root | project.outputRoot |
Blocking in every mode |
| Version or commit | project.versionOrCommit |
auto resolves the current SHA and pins it for the whole run |
| Due-diligence context | engagement.dueDiligenceContext |
Produce a general technical and product readiness assessment. Never invent transaction-specific acceptance criteria |
| Stakeholders | engagement.stakeholders |
Ownership is unassigned, which is a true statement; a plausible name is a false one |
| Constraints | engagement.constraints |
Each constraint that blocks a check becomes a not executed reason, not an unexplained gap |
| Disclosure policy | disclosure.policy |
Defaults to internal-only — draft the public documents fully, release none |
| Regulatory context | engagement.regulatory |
Identify candidates; applicability is itself a claim needing evidence |
| Allowed actions | engagement.allowedActions |
Restrictive defaults. The safe failure is an honestly-labelled unverified claim, not an unauthorized action |
| Delivery mode | engagement.deliveryMode |
full |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 140 lines · 135 tokens per session scan A 3a0a580c4b13
engagement-scoping is a skill published in the GitHub repository synaptiai/synapti-marketplace (6 stars, last pushed today), licensed Apache-2.0. It adds 135 tokens to every session and 2,012 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
step4-archive-spec
Archive a completed spec — moves it to specs-archived and blocks agent access.
plan-roadmap
Create or update a prioritized product roadmap with phased milestones.
x-dev
A development workflow for completing tasks from a task folder. It follows the task's README and checklist, implements work in dependency order, and records verification evidence.
x-req
A requirements planner that turns a confirmed request into a ready-to-build task package. It assigns a risk level from Q0 to Q3, where higher levels cover changes such as permissions, public interfaces, data migrations, or concurrency.
pocket-closing
Terminal pocket stage. User invokes after pocket-development's phase-level pass writes verdicts. Reconciles reviews against log.json, gates on REVIEWFAIL/REVIEWBLOCKED, advances REVIEW→DONE, runs log close, and emits a closeout summary. Trigger on "pocket-closing", "close the plan", "close out", "finalize plan", or…
product-manager
Use when writing user stories or acceptance criteria, defining product requirements, prioritising a feature backlog, creating a product roadmap, analysing product metrics, facilitating discovery for a new feature, evaluating trade-offs between product directions, or any task that requires deciding what to build and…