Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TashanGKD/tashan-cursor-skills --skill skill-sandbox-expandergit clone --depth 1 https://github.com/TashanGKD/tashan-cursor-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tashangkd/tashan-cursor-skills/skill-sandbox-expander)<a href="https://agentmods.dev/skills/tashangkd/tashan-cursor-skills/skill-sandbox-expander"><img src="https://agentmods.dev/badge/skills/tashangkd/tashan-cursor-skills/skill-sandbox-expander/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tashangkd/tashan-cursor-skills/skill-sandbox-expander"><img src="https://agentmods.dev/badge/skills/tashangkd/tashan-cursor-skills/skill-sandbox-expander.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00174 | $0.06680 |
| Opus 5 | $0.00087 | $0.03340 |
| Sonnet 5 | $0.00035 | $0.01336 |
| Haiku 4.5 | $0.00017 | $0.00668 |
Grade A, and why
skill-sandbox-expander scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 400 lines — stays where its author put it; the contents beside it link to each section on GitHub.
沙盘库系统化扩充(skill-sandbox-expander)
关系类型:depends-on(依赖 DOMAIN-REGISTRY + NODE-IO-CONTRACTS + SANDBOX-FORMAT) 关系类型:triggers(Phase 2 读取各域 SKILL.md;结果被 skill-domain-health-check / skill-domain-self-optimizer 消费) 强绑定 Rule:R2 NO_FABRICATION / R3 READ_FIRST / R6 ARTIFACT_FIRST / R1 EVIDENCE_FIRST
核心设计约束(执行前必须理解)
全量搜索约束(P9? F-021)——与两阶段分离同等优先级:
沙盘的目标不只是「入口宽度覆盖」(覆盖不同场景类型),还必须保证「链路深度完整性」:
- 对每个入口:必须追踪完整的使用链路(一次闭环可能有 N 步,必须走完所有步)
- 对每个分叉点:基于不同反馈会产生不同分支,所有主要分支都必须被覆盖(可以由多个沙盘共同覆盖一个入口的所有分支)
- 一个沙盘 = 一个完整链路实例:描述某个入口在某种反馈路径下的完整走法,而不是只描述入口和出口
❌ 不合格的场景规划:「用户触发产品定义 → 产品经理输出产品定义文档」
✅ 合格的场景规划:
场景A:用户触发产品定义,第一次问答后用户满意 → 关卡A → 关卡B → 开发
场景B:用户触发产品定义,关卡A 发现设计漏洞 → 用户修改 → 重新过关卡A → 关卡B → 开发
场景C:用户触发产品定义,关卡B 发现架构问题 → 回到技术架构师 → 修改 → 重过关卡B
(三个沙盘合并覆盖「产品定义」入口的全量路径)
Step 3(场景建议)的全量搜索要求:
- 每个入口节点,首次覆盖时必须建议 2-3 个沙盘(覆盖主链路 + 主要分叉分支)
- 已有沙盘的入口,检查现有沙盘是否已覆盖所有主分支,缺失的分支优先级高于全新入口
两阶段分离是本 Skill 最关键的第二约束:
- Phase 1(预想)= 只能读 DOMAIN-REGISTRY + NODE-IO-CONTRACTS + SANDBOX-FORMAT + 已有沙盘 frontmatter(前7行),禁止打开任何 .cursor/skills/*/SKILL.md 文件
- Phase 2(实际验证)= 才可以读对应 SKILL.md 文件
违反这个约束 = Phase 1 被污染 = 沙盘失去验证价值。
节点→文件路径规则(Phase 2 使用):
- 标准 Skill:
.cursor/skills/[Skill目录名]/SKILL.md(目录名 = DOMAIN-REGISTRY Skill列的值) - 若文件不存在 → 记为「❌ 缺失节点」Gap,继续其他节点
执行模式判断(Step 1 开头执行)
IF 被其他 Skill 作为子任务调用(子任务模式):
→ 从调用方传入的参数中读取:域名 + 目标数量 + 模式
→ 参数格式:{ domain: "[域名]", count: [数量], mode: "新增" or "补全draft" }
→ 若 count > 20,自动截断为 20,并在输出中标注「已截断:原参数 count=[原值],上限为20」
→ 跳过所有「询问用户」和「等待用户确认」的交互步骤,直接执行
→ 跳过 auto-experience-hook 的 Step 3 任务日志写入(由主任务统一记录)
ELSE IF 用户意图为「补全已有 draft」(触发词包含「草稿」「draft」「补完」「补全」之一):
→ 直接进入模式:跳过 Step 3-4(Phase 1 生成),直接从 Step 5 开始执行
→ 先询问:「请指定域(产品开发/认知结构/公司运营/内容宣传/Skill体系/全部)」
→ 等用户确认后,Step 5 扫描目标域的所有 status="draft" 沙盘作为处理列表
ELSE(用户直接触发新增沙盘):
→ 执行 Step 1 的交互式询问流程
关于 skill-closure-verifier-meta 的关系澄清: verifier-meta Step 4 有自己的 inline Phase 2 逻辑(快速补全 draft 沙盘),与本 Skill 的 Phase 2 是两套独立实现,各自触发:
- verifier-meta inline Phase 2:在全量验证运行中快速补全 draft 状态的沙盘
- 本 Skill Phase 2(完整版):包含 Gap 证据链要求和质量门槛,用于系统化扩充 两套机制不互相调用,不造成覆盖冲突。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 400 lines · 174 tokens per session scan A 11077c239496
skill-sandbox-expander is a skill published in the GitHub repository TashanGKD/tashan-cursor-skills (20 stars, last pushed 5mo ago), licensed MIT. It adds 174 tokens to every session and 6,680 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
android-preflight
Final verification checklist to run before declaring Android work finished — build, both themes, string resources, lifecycle and leak risks, registered permissions and components, resource parity between values and values-night, and honest reporting of what was and was not verified. Use at the end of any feature, fix…
qa
QA lead testing mode with browser automation. Tests affected pages, fills forms, takes screenshots. Use when user says /qa, wants to test the app, needs QA verification, or wants browser-based testing.
chaos
Failure injection — stress test implementations under hostile conditions before shipping.
qa
Systematic QA pass — test the feature, find bugs, report with repro steps.
template-helpers
Catalog of the reusable building blocks shipped with this Android template — BaseActivity/BaseFragment, the helpers/ extension files (navigation, lifecycle, toast, snackbar, dialogs, images, permissions, theme, locale, settings intents, date, delay), common/ (Firebase, network, observers), and…
android-feature
Workflow for implementing a new Android feature, screen, fragment, activity, dialog, adapter, or enhancement in this XML/MVVM template. Use whenever the user asks to add, build, implement, or extend functionality — before writing any code. Covers planning, the MVVM/MVI skeleton, the Android configuration checklist…