A Portuguese-language workflow for hiring a new project agent through an eight-stage pipeline. It builds a scorecard, researches relevant skills and tools, and requires several human approvals.

Use it to brief a new agent, discover and curate skills, define its responsibilities and scope, choose a command alias, and approve the final agent file.

It replaces an informal hiring request with a recorded process that checks the project context, candidate fit, recommendations, and independent verification.

contratar — Skill by thaleslaray

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/thaleslaray/plugins/contratar

Any agent

npx skills add thaleslaray/plugins --skill contratar

Clone the repo

git clone --depth 1 https://github.com/thaleslaray/plugins

Made for: Claude Code, Codex.

Per session 212 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 7,474 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00212	$0.07474
Opus 5	$0.00106	$0.03737
Sonnet 5	$0.00042	$0.01495
Haiku 4.5	$0.00021	$0.00747

Measured 2d ago against content hash 809a5c5133b0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

contratar scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 6 executable files (scripts/fetch-external-skills.py, scripts/fetch-mcps.py, scripts/fetch-registries.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

elif [ -n "$(find "$HOME/.claude/plugins" -path '*/pesquisa/SKILL.md' -type f 2>/dev/null | head -1)" ]; then echo "FOUND_PLUGIN"

plugins/rh/skills/contratar/SKILL.md · 669 lines

How it starts

The opening of the file, as written. The whole thing — 669 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/rh:contratar

Esta skill é self-enforcing. Cinco regras mecânicas:

State machine em disco. Cada stage atualiza .claude/rh-state.json. Hook PreToolUse em Write bloqueia Write em .claude/agents/*.md se Stages 3-7 não estiverem complete + scorecard approved + curation resolved + verifier pass.
Tool aninhada retornou instruções em vez de executar = ABORTE. Se uma tool responde com seu próprio SKILL.md (sinal de carregamento sem execução autônoma), NÃO substitua por chamadas próprias. Aborte o stage, marque status: aborted com abort_reason, avise o fundador.
Blocos <LITERAL_DO_NOT_ADAPT> são verbatim. Opções de AskUserQuestion marcadas são copiadas literalmente. Adaptar = violação.
7 HITLs inviolável (v0.4.0). Mesmo em modo automático: briefing (3 perguntas), aprovação do scorecard, aprovação da recomendação curada (Stage 5.0, NÃO item-a-item — apresenta tabela com scores e fundador aprova bloco), ênfase do agente, escopo do agente (global vs projeto), slash-command alias, aprovação final.
Confiança HIGH exige verifier externo. Stage 6 só pode marcar verifier_verdict: pass quando verifier independente valida o JSON. Ordem obrigatória: Agent({subagent_type: Explore}) primeiro (subscription, custo zero). claude -p apenas como fallback quando Agent falha 2x (consome API). Sem verifier rodado, máximo é MÉDIA.

Contrata um agente pro projeto atual via pipeline scorecard-first portado do /matriz:contratar 5.5.0 e adaptado pro contexto de projeto-qualquer (sem brand/, sem company.md, sem employees.json).

Audiência: aluno da imersão Operação AutonomIA T1+ que quer escalar contratação com curadoria do inventário real de skills, não suposições do LLM.

Pré-requisito hard: skill /pesquisa instalada (para o Stage 6 — pesquisa externa de gaps).

Resultado: 1 arquivo .claude/agents/{slug}.md + .claude/rh-state.json com trilha auditável de 8 stages + .claude/rh-research/{slug}-{date}.json (research) + .claude/rh-research/{slug}-{date}.verifier.json (verifier report).

Read the full file on GitHub · 669 lines

Files

What ships with it

14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 669 lines · 212 tokens per session scan B 809a5c5133b0

Subscribe to this mod's changes

contratar is a skill published in the GitHub repository thaleslaray/plugins (2 stars, last pushed 3mo ago), licensed MIT. It adds 212 tokens to every session and 7,474 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Building agents Planning

mcporter

List, auth, and call MCP servers/tools from the terminal.

NousResearch/hermes-agent · 16 tokens

📝 任务完成后归档

重要提醒: 每次完成复杂调试或开发任务后，主动执行此流程！将学到的经验归档为 skill，供以后参考。不要等用户提醒。.

Project-N-E-K-O/N.E.K.O · 49 tokens

oracle

Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).

the-open-agent/openagent · 25 tokens

agent-mode

Unified tool for managing agent LLM modes (add, remove, update, list, switch).

PhyAgentOS/PhyAgentOS-core · 22 tokens

agento11y-prod-setup

Sets up production evaluation and guardrails for a DEPLOYED AI agent in Grafana Agent Observability, grounded in the agent's own code and its real ingested traffic. The judgment layer on top of the agento11y skill: it reads the agent's source (system prompt, tools, entrypoint) AND samples its live traffic via gcx…

grafana/gcx · 259 tokens

mcp-scripting

Write mcpScript JavaScript for discovering, inspecting, and calling MCP tools.

nicobailon/pi-mcp-adapter · 21 tokens

contratar