Claude Code Thinking Skills is a catalogue of 28 portable skills that give coding agents structured procedures for reasoning about decisions, diagnosis, risk, strategy, and related problems. It is intended for Claude Code, GitHub Copilot, Codex, Cursor, and other tools that support Agent Skills.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tjboudreaux/cc-thinking-skills --skill thinking-margin-of-safetygit clone --depth 1 https://github.com/tjboudreaux/cc-thinking-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tjboudreaux/cc-thinking-skills/thinking-margin-of-safety)<a href="https://agentmods.dev/skills/tjboudreaux/cc-thinking-skills/thinking-margin-of-safety"><img src="https://agentmods.dev/badge/skills/tjboudreaux/cc-thinking-skills/thinking-margin-of-safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tjboudreaux/cc-thinking-skills/thinking-margin-of-safety"><img src="https://agentmods.dev/badge/skills/tjboudreaux/cc-thinking-skills/thinking-margin-of-safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.00746 |
| Opus 5 | $0.00018 | $0.00373 |
| Sonnet 5 | $0.00007 | $0.00149 |
| Haiku 4.5 | $0.00004 | $0.00075 |
Grade A, and why
thinking-margin-of-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Margin of Safety
Core rule: commit a buffered number when residual uncertainty plus breach cost can cause ruin or costly failure. Margin covers estimation error; it is not free slack for laziness.
When to Use
- Capacity, timeouts, pool sizes, queue depths, storage, or SLA numbers under load uncertainty
- Timeline or budget commitments where underestimation is costly
- Architecture headroom when scaling or recovery is slow
- Any public or production commitment where being wrong has asymmetric downside
When NOT to Use
- Breach is detected immediately and fixed near-zero cost (fast auto-scale, live-tunable limit)—static fat buffers waste resources
cost(buffer) > P(breach) × cost(breach)—right-size or measure instead of maxing out- Uncertainty is eliminable by measurement or lookup—get the real number first
- Stopping-criterion / search budget problems—use bounded rationality, not padding
- Fully known parameters and low stakes where edge optimization is the goal
Procedure
- Point estimate without padding. State the base requirement in explicit units (RPS, weeks, GB, ms) and confidence (high / medium / low).
- Uncertainty and breach cost. List drivers (spike, growth, unknowns, dependency variance). State what fails if undershot: outage, missed launch, data loss, reputation—and whether failure is recoverable or ruinous.
- Size the buffer. Multiply or add margin to residual uncertainty and stakes—not to vanity. Typical bands (adjust with evidence):
- Well-known, low consequence: ~1.2–1.5×
- Familiar with unknowns / reversible: ~1.5–2×
- New domain, external deps, SLA, irreversible: ~2–3× Cap or cut when buffer cost exceeds expected breach cost.
- Ruin constraint. If a breach can cause irreversible harm, size so the worst plausible miss still stays above the failure threshold; if that buffer is unaffordable, change the design (shed load, degrade, stage) rather than pretend precision.
- Strongest countercase. Challenge both under-buffering ("we will scale later") and over-buffering (idle cost, complexity). Prefer measure-then-trim when history exists.
- Commit and monitor. Publish the buffered commitment, the failure threshold, and the metric that would prove margin excessive or thin. Stop when the number is set and monitorable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 57 lines · 37 tokens per session scan A f71486975e31
thinking-margin-of-safety is a skill published in the GitHub repository tjboudreaux/cc-thinking-skills (1,306 stars, last pushed 1mo ago), licensed MIT. It adds 37 tokens to every session and 746 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
forensic-read
Read any document the way a detective reads a witness statement — surface what it is NOT saying. Unlike a summarizer (which tells you what a text says), this skill exposes the subtext: hedging and weasel words, conspicuous omissions, buried leads, frequency tells, tone shifts, and non-answers. Use it on earnings…
pre-mortem
Find what will kill a plan before it's committed to — by assuming it already failed and working backwards to the causes. Based on Gary Klein's pre-mortem technique. Unlike generic "what are the risks?" brainstorming, this skill imagines a specific, vivid failure six months out, reasons back to the most likely causes…
second-order
Reason past the obvious, first-order consequence to the second-, third-, and long-tail effects everyone else stops short of. Where most analysis says "X causes Y", this skill asks "and then what?" — mapping the cascade, surfacing the non-obvious winners and losers, the reflexive responses, and the effects that only…
foundation-models
On-device LLM integration using Apple's Foundation Models framework. Use when implementing AI text generation, structured output, or tool calling.
analytics-interpretation
Interpret app metrics and make data-driven decisions. Covers DAU/MAU, retention, LTV, ARPU, App Store Connect analytics, AARRR funnel analysis, cohort analysis, and diagnostic decision trees. Use when user wants to understand their metrics, diagnose problems, or build a data-driven growth plan.
app-namer
Turn an app idea into validated, App-Store-ready name candidates. Use when the user says "name my app", "what should I call it", "app name ideas", "help me name this app", "is this name available", or needs to pick a brandable, ownable name before reserving it in App Store Connect.