Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TOKTOKHAN-DEV/agent-company --skill run-preflightgit clone --depth 1 https://github.com/TOKTOKHAN-DEV/agent-companyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/toktokhan-dev/agent-company/run-preflight)<a href="https://agentmods.dev/skills/toktokhan-dev/agent-company/run-preflight"><img src="https://agentmods.dev/badge/skills/toktokhan-dev/agent-company/run-preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/toktokhan-dev/agent-company/run-preflight"><img src="https://agentmods.dev/badge/skills/toktokhan-dev/agent-company/run-preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 26 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00003 | $0.00723 |
| Opus 5.5 | $0.00001 | $0.00289 |
| Sonnet 5.5 | $0.00001 | $0.00145 |
| Haiku 4.5 | $0.00000 | $0.00072 |
Grade A, and why
run-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
run-preflight
1. 빌드부터 한다
preflight 의 번들 검사는 산출물이 있어야 돈다.
pnpm typecheck
pnpm build:miniapp
pnpm preflight
pnpm preflight 만 돌리면 bundle 항목이 warn 으로 남는다. 그 상태로 "통과" 라고 보고하지
않는다.
2. error 를 해석한다
| 규칙 | 뜻 | 넘길 곳 |
|---|---|---|
config |
appName 이 기본값이거나 .env 와 불일치 | 사람 (콘솔 식별자 확인 필요) |
privacy |
개인정보처리방침 URL 없음 | 사람 |
no-eval · wss-only · share-scheme |
금지 패턴이 소스에 있음 | ui-builder |
light-only |
다크 모드 분기가 있음 | ui-builder |
tds |
TDS 를 안 씀 | ui-builder |
no-zoom |
viewport 에 user-scalable=no 없음 | ui-builder |
specs |
수용 기준 없는 명세 | spec-writer |
bundle-size |
100MB 초과 | ui-builder (에셋을 CDN 으로) |
static-only |
정적 산출물이 아님 | ui-builder (SSR 제거) |
직접 고치지 않는다. 당신의 쓰기 범위는 release/** 다.
3. 기계가 못 잡는 것을 목록으로 만든다
preflight 가 통과해도 심사의 절반은 남아 있다. wiki/04-review-checklist.md 에서 이번
릴리즈에 해당하는 항목을 뽑아 사람이 실기기에서 확인할 목록을 만든다.
특히 기계로 못 잡는 것:
- 인터랙션이 2초 안에 반응하는가
- 뒤로가기 버튼이 두 개 동시에 보이지 않는가
- 결제·광고 중 배경음이 멈추는가
- 광고가 미리 로드되는가 (실시간 로딩 금지)
- 배너가 스크롤 화면에만 뜨는가
- 비속어·과도한 유행어가 없는가
4. 릴리즈 노트를 쓴다
release/<버전>.md:
# v<버전>
## 들어간 것
- <명세 파일 기준으로>
## preflight
- error 0 / warn N
- 번들 <크기>MB (상한 100MB)
## 사람이 확인할 것
- [ ] <항목>
## 다음
콘솔에서 검수 신청 버튼을 누르세요. 영업일 3일까지 걸립니다.
출력
- preflight 결과 (error/warn 수, 규칙별)
- 넘긴 곳 (어떤 error 를 누구에게)
- 사람 확인 목록
- 검수 신청은 사람이 누른다는 안내
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 79 lines · 3 tokens per session scan A c1deef3a6805
run-preflight is a skill published in the GitHub repository TOKTOKHAN-DEV/agent-company (85 stars, last pushed 2mo ago), licensed MIT. It adds 3 tokens to every session and 723 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
swift-protocol-di-testing
Protocol-based dependency injection for testable Swift code — mock file system, network, and external APIs using focused protocols and Swift Testing.
accessibility-testing
WCAG compliance testing and accessibility quality assurance workflows for iOS apps. Use when validating accessibility labels, testing VoiceOver compatibility, checking contrast ratios, or ensuring WCAG 2.1 compliance. Covers accessibility tree analysis, semantic validation, and automated accessibility testing patterns.
ios-testing-patterns
XCTest and XCUITest execution workflows and flaky test detection patterns.
simulator-workflows
Use the executesimulatorcommand MCP tool for all simulator management.
xcode-workflows
Xcode build system guidance for xcodebuild operations. Use when building iOS projects, running tests, analyzing build failures, or configuring schemes. Covers build/clean/test operations, interpreting xcodebuild output, and troubleshooting common build errors.
qa-testing-android
Designs Android testing with Espresso, UI Automator, Robolectric, and Compose. Use when planning device matrices, emulator CI, Compose test migration, screenshots, or flakes.