Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wayne930242/straw-boss/inspecting-appnpx skills add wayne930242/straw-boss --skill inspecting-appgit clone --depth 1 https://github.com/wayne930242/straw-bossWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wayne930242/straw-boss/inspecting-app)<a href="https://agentmods.dev/skills/wayne930242/straw-boss/inspecting-app"><img src="https://agentmods.dev/badge/skills/wayne930242/straw-boss/inspecting-app.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.00460 |
| Opus 5 | $0.00043 | $0.00230 |
| Sonnet 5 | $0.00017 | $0.00092 |
| Haiku 4.5 | $0.00009 | $0.00046 |
Grade A, and why
inspecting-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Overview
See docs/roles.md for the cast of characters and the authority framework this skill operates under — not redefined here.
Resolve the app, choose the smallest sufficient loop through choosing-graph, and assess it against real rule sources. This skill supplies the app boundary; the selected audit skill supplies the method.
Task 1: Resolve the app
Invoke work-on now. Do not proceed without the target app.
- If
work-onasked a clarifying question (an ambiguous name matching more than one app'smatchphrases) or found the request out of the project's managed-app scope, stop here and surface that to the user — don't guess an app to keep moving. - If
work-onnamed more than one app, treat Task 2 as running once per app rather than picking one arbitrarily; each app's audit is independent.
Verification: the target app(s) are established before Task 2, or you've surfaced work-on's clarifying question / out-of-scope result instead of proceeding.
Task 2: Run an evidence-bearing audit
For a bounded single-loop, continue in the current agent with the app's instructions loaded. Use fan-out for clear independent branches, or dispatching-work when the audit benefits from a separate durable workroom. A confirmed lower-tier work route may carry a bounded audit.
Frame the audit around the applicable rule, observed behavior, and consequence. Require evidence references to the exact rule and implementation, test, log, or artifact. These references are what this work's anchor attacks; with no operable artifact, adversarial-review is the reality anchor for the finished assessment.
Verification: the evidence-backed assessment explains the result, cites both rule and observed evidence, and records its anchor disposition.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 28 lines · 86 tokens per session scan A 229f32c3fd75
inspecting-app is a skill published in the GitHub repository wayne930242/straw-boss (3 stars, last pushed 2d ago), licensed MIT. It adds 86 tokens to every session and 460 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
issue-analyze
GitHub Issue and PR review thread deep analysis with Codex blind verdict. Use when: analyzing issue root cause, classifying problems, investigation planning, triaging PR review comments for actionability. Not for: fixing bugs (use bug-fix), code exploration (use code-explore). Output: classified analysis + verdict…
load-pr-review
Load GitHub PR review comments into AI session — analyze, triage, plan. Default: analysis-only (no auto-fix). Use when: reviewing PR feedback, planning fixes, addressing review comments, replying to reviewers. Not for: creating reviews (use codex-review-fast), creating PRs (use create-pr), viewing PR status (use…
refactor
Multi-target refactoring orchestrator. Use when: cleaning up messy code/docs, simplifying code, restructuring documents, batch cleanup. Not for: new features (use feature-dev), bug fixes (use bug-fix), code understanding (use code-explore). Output: refactored code/docs + review gate.
best-practices
Industry best practices conformance audit with mandatory adversarial debate. Produces audit artifact: verdict (OK/WARN/FAIL) + gap roadmap + debate proof. Use when: auditing current implementation against industry standards, checking compliance with best practices, benchmarking implementation quality, verifying a…
review-spec
Review technical spec documents from completeness, feasibility, risk, and code consistency perspectives.
pre-pr-audit
Pre-PR confidence audit with 5-dimension scoring. Use when: final check before commit/push/PR, evaluating PR readiness, assessing test quality + risk + coverage holistically. Triggers: pre-pr, readiness check, confidence audit, final verification, ready to PR, how confident. Not for: code review (use…