Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add timurgaleev/vibestack --skill carefulgit clone --depth 1 https://github.com/timurgaleev/vibestackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/timurgaleev/vibestack/careful)<a href="https://agentmods.dev/skills/timurgaleev/vibestack/careful"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/careful/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/timurgaleev/vibestack/careful"><img src="https://agentmods.dev/badge/skills/timurgaleev/vibestack/careful.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.02516 |
| Opus 5.5 | $0.00011 | $0.01006 |
| Sonnet 5.5 | $0.00005 | $0.00503 |
| Haiku 4.5 | $0.00003 | $0.00252 |
Grade D, and why
careful scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `sudo rm` | `sudo rm -r /opt/x` | Delete as root | Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
Safety guardrails that warn before destructive commands like rm -rf, DROP TABLE, force-push or reset --hard. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `curl`/`wget` piped to a shell, or `bash <(curl …)` | `curl -fsSL https://x.sh \| sudo -E bash` | Runs unread downloaded code | This is a copy
88% identical to careful — 163 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to invoke
Use when touching prod, debugging live systems, or working in a shared environment. Use when asked to "be careful", "safety mode", "prod mode", or "careful mode".
/careful — Destructive Command Guardrails
Safety mode is now active. Every Bash and PowerShell command will be checked for destructive patterns before running. Most matches warn and are overridable; a small catastrophic set is blocked outright.
Where this is enforced. The checks run as a Claude Code PreToolUse hook.
Cursor, Kiro and Codex install the same skill, but the hook is not guaranteed
to run there; outside Claude Code /careful is instruction-only. On those
hosts, tell the user that safety mode is advisory: you will stop and confirm
before a command from the table below, but nothing intercepts it if you miss
one.
Copilot CLI is the exception. When the configuration payload is installed
(./install --with-config or --only=config), the user hook file
~/.copilot/hooks/vibestack.json (under $COPILOT_HOME when set) runs the same
check on every Bash and PowerShell command and on every edit to a gate file
(see Gate files below), so on Copilot CLI /careful is always on, in every
session, whether or not it was invoked. Without the
configuration payload it is instruction-only there as well.
Two tiers
| Tier | Decision | Applies to |
|---|---|---|
| HIGH | deny — blocked, not overridable while /careful is active |
Recursive delete of / or the home directory; force-push to the repo's default branch. Only simple commands qualify — anything with ;, &&, ` |
| MEDIUM | ask — warns, always overridable |
Every pattern in the table below. |
This is a best-effort advisory stop, not a policy boundary: it reads the command
as text and cannot out-parse a shell. To lift a HIGH deny, end the /careful
session.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed · +1 lines d5bbf6e033bb
- 12d ago Changed · +8 lines 0ad0ba24ba2a
- 14d ago Changed · +36 lines scan C → D ae57e552f5e2
- 16d ago Changed · -45 tokens per session 89fcfab8cace
- 17d ago Changed · +34 lines 1ed24602d8b9
- 1mo ago Changed · +47 lines · +28 tokens per session 63dd13ae620d
- 1mo ago First seen · 56 lines · 44 tokens per session scan C 0cfc424c9371
careful is a skill published in the GitHub repository timurgaleev/vibestack (7 stars, last pushed 11d ago), licensed MIT. It adds 27 tokens to every session and 2,516 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). It is 88% identical to careful, differing in 163 lines, and is treated as a copy.
Other skills, from other repositories
artifact-deploy
One-click deploy a user's pre-built app/artifact into their OWN AWS account and get a global public HTTPS link (Vercel-like), with a default TTL and promote-to-persistent. Use when the user says "deploy this", "ship this demo", "give me a public link", "share this externally", or "deploy to AWS".
explain-for
Explain a topic, code, error or design decision for one named audience (a 5-year-old, a manager, a designer, a grad student, a parent). Resolves who it is for, pins the ground truth first, then tunes vocabulary, analogy, tone and depth to that audience. Use when an audience is named.
web-verify
Use after a user-visible UI edit to verify your OWN change on an isolated loopback server. Capture, read and show real screenshots. Backends: playwright-cli (live Browser panel), agent-browser (annotated frames, pixel diff, a11y), or scripted Playwright. Not web-preview or external-page web-browse.
learn-from-sage
Detection-gap (miss) analysis for Code Review Sage. Learn from shipped fixes, acted-on human comments, and design outcomes to close reviewer blind spots. Inline during review stages a candidate; a human triggers a one-shot AI consolidation into the live ruleset.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.
web-preview
Emit a hidden preview marker so the right-panel Browser tab opens a Load-preview card for a local server URL. Use whenever you start a dev or static server the user should see (Vite, Next, npm run dev, python -m http.server, etc.).