Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TOKTOKHAN-DEV/agent-company --skill run-preflightgit clone --depth 1 https://github.com/TOKTOKHAN-DEV/agent-companyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/toktokhan-dev/agent-company/run-preflight)<a href="https://agentmods.dev/skills/toktokhan-dev/agent-company/run-preflight"><img src="https://agentmods.dev/badge/skills/toktokhan-dev/agent-company/run-preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/toktokhan-dev/agent-company/run-preflight"><img src="https://agentmods.dev/badge/skills/toktokhan-dev/agent-company/run-preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 26 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00003 | $0.00723 |
| Opus 5 | $0.00002 | $0.00362 |
| Sonnet 5 | $0.00001 | $0.00145 |
| Haiku 4.5 | $0.00000 | $0.00072 |
Grade A, and why
run-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
run-preflight
1. 빌드부터 한다
preflight 의 번들 검사는 산출물이 있어야 돈다.
pnpm typecheck
pnpm build:miniapp
pnpm preflight
pnpm preflight 만 돌리면 bundle 항목이 warn 으로 남는다. 그 상태로 "통과" 라고 보고하지
않는다.
2. error 를 해석한다
| 규칙 | 뜻 | 넘길 곳 |
|---|---|---|
config |
appName 이 기본값이거나 .env 와 불일치 | 사람 (콘솔 식별자 확인 필요) |
privacy |
개인정보처리방침 URL 없음 | 사람 |
no-eval · wss-only · share-scheme |
금지 패턴이 소스에 있음 | ui-builder |
light-only |
다크 모드 분기가 있음 | ui-builder |
tds |
TDS 를 안 씀 | ui-builder |
no-zoom |
viewport 에 user-scalable=no 없음 | ui-builder |
specs |
수용 기준 없는 명세 | spec-writer |
bundle-size |
100MB 초과 | ui-builder (에셋을 CDN 으로) |
static-only |
정적 산출물이 아님 | ui-builder (SSR 제거) |
직접 고치지 않는다. 당신의 쓰기 범위는 release/** 다.
3. 기계가 못 잡는 것을 목록으로 만든다
preflight 가 통과해도 심사의 절반은 남아 있다. wiki/04-review-checklist.md 에서 이번
릴리즈에 해당하는 항목을 뽑아 사람이 실기기에서 확인할 목록을 만든다.
특히 기계로 못 잡는 것:
- 인터랙션이 2초 안에 반응하는가
- 뒤로가기 버튼이 두 개 동시에 보이지 않는가
- 결제·광고 중 배경음이 멈추는가
- 광고가 미리 로드되는가 (실시간 로딩 금지)
- 배너가 스크롤 화면에만 뜨는가
- 비속어·과도한 유행어가 없는가
4. 릴리즈 노트를 쓴다
release/<버전>.md:
# v<버전>
## 들어간 것
- <명세 파일 기준으로>
## preflight
- error 0 / warn N
- 번들 <크기>MB (상한 100MB)
## 사람이 확인할 것
- [ ] <항목>
## 다음
콘솔에서 검수 신청 버튼을 누르세요. 영업일 3일까지 걸립니다.
출력
- preflight 결과 (error/warn 수, 규칙별)
- 넘긴 곳 (어떤 error 를 누구에게)
- 사람 확인 목록
- 검수 신청은 사람이 누른다는 안내
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 79 lines · 3 tokens per session scan A c1deef3a6805
run-preflight is a skill published in the GitHub repository TOKTOKHAN-DEV/agent-company (77 stars, last pushed 13d ago), licensed MIT. It adds 3 tokens to every session and 723 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
product-verification
Drive the running product and verify it works end-to-end. Use this skill after a deploy, before a release, or when the user says "verify", "smoke test", "does it work", "test the flow", "check staging", "end-to-end test", or "drive the product". Also use when the user wants to verify a specific user journey (signup…
smoke-test
Post-sprint validation. Verifies the application works as expected after a sprint completes. Use after any sprint or deployment, or when the user says "smoke test", "verify it works", "test the app", "does it still work", "regression check", "post-deploy check", or "sanity check". Invoked by SP-QA during post-sprint…
android-kotlin
Android Kotlin development with Coroutines, Jetpack Compose, Hilt, and MockK testing.
verify-implementation
A workflow that runs a project’s verification skills to produce a report on coding patterns, architecture rules, and project conventions. It is intended for work after implementation, before a pull request, or during code review.
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
verify
Runs this project's check chain through scripts/verify.py and reads the receipt it writes. Fires when tracked changes are finished, when the user asks whether work passes, before a commit, and before reporting a task done. Stays dormant in repositories with no detectable check chain, during read-only audits, and for…