Borrowing it
Nothing to install: this file belongs to thomaspinder/Impulso. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/thomaspinder/Impulso/main/.agents/skills/impulso-workflow/SKILL.mdgit clone --depth 1 https://github.com/thomaspinder/ImpulsoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thomaspinder/impulso/impulso-workflow)<a href="https://agentmods.dev/skills/thomaspinder/impulso/impulso-workflow"><img src="https://agentmods.dev/badge/skills/thomaspinder/impulso/impulso-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thomaspinder/impulso/impulso-workflow"><img src="https://agentmods.dev/badge/skills/thomaspinder/impulso/impulso-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00162 | $0.01564 |
| Opus 5.5 | $0.00065 | $0.00626 |
| Sonnet 5.5 | $0.00032 | $0.00313 |
| Haiku 4.5 | $0.00016 | $0.00156 |
Grade A, and why
impulso-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to impulso-audit — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Impulso Codebase Audit
Full-scope audit of a Bayesian Vector Autoregressive (VAR) and structural VAR library. Run against a local checkout.
Workflow
Execute phases 1–7 in order. Each phase gathers findings. Phase 8 compiles the report.
Phase 1: Repository Discovery
Understand the repo before auditing. Read these files (skip missing ones):
pyproject.toml
setup.cfg / setup.py (if present)
.github/workflows/*.yml
.pre-commit-config.yaml
uv.lock (first 50 lines)
Makefile / justfile (if present)
Record:
- Python version constraints (requires-python)
- Dependency list and version pins
- Dev/test dependency groups
- Build backend (hatchling, setuptools, etc.)
- uv workspace configuration if any
- Linter/formatter config (ruff, mypy, ty, etc.)
Phase 2: Code Standards Audit
Read references/code-standards.md for the full checklist, then scan the source tree.
For each .py file under the main package directory:
- Sample files proportionally — read ALL files in small packages (<30 files), or ~40% in larger ones, prioritising core modules (spec, data, fitted, identified, priors, samplers, results).
- Check against each item in the checklist, including the Probabilistic Programming / Domain-Specific and Protocols and Extensibility sections.
- Record concrete findings with file paths and line numbers where possible.
Phase 3: Pydantic Usage Audit
Read references/pydantic-checklist.md for the full checklist, then audit all Pydantic models.
- Use the Grep tool to find all
BaseModelsubclasses: patternclass \w+\(BaseModel\)insrc/impulso/. - For each model, check against the checklist items: model_config consistency, Field constraints, validator patterns, serialization, arbitrary_types_allowed usage, v2 feature adoption, and performance.
- Pay special attention to:
- Whether a shared base model class would reduce
model_configduplication - Whether
arbitrary_types_allowedis justified for each model - Whether
model_construct()is used in internal code paths that build models from already-validated data - Whether
@computed_fieldcould replace any manual@propertydefinitions
- Whether a shared base model class would reduce
- Record concrete findings with file paths and line numbers.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 129 lines · 162 tokens per session scan A a91ea0407919
impulso-audit is a skill published in the GitHub repository thomaspinder/Impulso (25 stars, last pushed 1mo ago), licensed MIT. It adds 162 tokens to every session and 1,564 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to impulso-audit, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
mcore-linting-and-formatting
Linting and formatting for Megatron-LM. Covers running autoformat.sh, tools (ruff, black, isort, pylint, mypy), and code style rules.
splitting-oversized-modules
Split an oversized Python module (a thousand-plus-line logic.py, models.py, api.py, or its test file) into a package of one module per concern, mechanically and provably without changing behavior. Use on a request to split / break up / decompose a god module or move functions out of one, once a human has agreed to…
python-review-checklist
Deterministic Python review checklist shipped with the CAO skills-lifecycle example.
splitting-oversized-modules
Split an oversized Python module (a thousand-plus-line logic.py, models.py, api.py, or its test file) into a package of one module per concern, mechanically and provably without changing behavior. Use on a request to split / break up / decompose a god module or move functions out of one, once a human has agreed to…
coding.make_function_private
Identify private or public functions in a file and rename with underscore.
coding_qa.review
Review Python files for bugs, suggest fixes, and provide test cases.