Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wayne930242/straw-boss --skill investigating-appgit clone --depth 1 https://github.com/wayne930242/straw-bossWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wayne930242/straw-boss/investigating-app)<a href="https://agentmods.dev/skills/wayne930242/straw-boss/investigating-app"><img src="https://agentmods.dev/badge/skills/wayne930242/straw-boss/investigating-app/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wayne930242/straw-boss/investigating-app"><img src="https://agentmods.dev/badge/skills/wayne930242/straw-boss/investigating-app.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.00456 |
| Opus 5 | $0.00044 | $0.00228 |
| Sonnet 5 | $0.00017 | $0.00091 |
| Haiku 4.5 | $0.00009 | $0.00046 |
Grade A, and why
investigating-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Overview
See docs/roles.md for the cast of characters and the authority framework this skill operates under — not redefined here.
Resolve the app, choose the smallest sufficient loop through choosing-graph, and produce an evidence-backed explanation. This skill supplies the app boundary; the selected research skill supplies the method.
Task 1: Resolve the app
Invoke work-on now. Do not proceed without the target app.
- If
work-onasked a clarifying question (an ambiguous name matching more than one app'smatchphrases) or found the request out of the project's managed-app scope, stop here and surface that to the user — don't guess an app to keep moving. - If
work-onnamed more than one app, treat Task 2 as running once per app rather than picking one arbitrarily; each app's research is independent.
Verification: the target app(s) are established before Task 2, or you've surfaced work-on's clarifying question / out-of-scope result instead of proceeding.
Task 2: Run an evidence-bearing investigation
For a bounded single-loop, continue in the current agent with the app's instructions loaded. Use fan-out for clear independent branches, or dispatching-work when the research benefits from a separate durable workroom. A confirmed lower-tier work route may carry bounded fact gathering.
Frame the work around the behavior, structure, mechanism, cause, or impact to explain. Require file/line, test, log, command, or artifact evidence references. These references are what this work's anchor attacks; with no operable artifact, adversarial-review is the reality anchor for the finished account.
Verification: the report explains the finding, cites evidence, and records its anchor disposition.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 28 lines · 87 tokens per session scan A 475886589fb9
investigating-app is a skill published in the GitHub repository wayne930242/straw-boss (3 stars, last pushed yesterday), licensed MIT. It adds 87 tokens to every session and 456 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
codex-setup
Initialize sd0x-dev-flow infrastructure for Codex CLI and other non-Claude agents. Generates AGENTS.md, installs the commit-msg hook, copies runner scripts. The pre-push gate is opt-in via --with-push-gate. Use when setting up a new project or after updating skills.
create-request
Create, update, or scan per-task request tickets for progress tracking. These are date-prefixed non-lifecycle docs under requests/, NOT feature-level requirements (use /req-analyze for those). Use when: tracking task progress, updating completion status, scanning incomplete requests, checking request status dashboard.…
smart-rebase
Smart partial rebase for squash-merge repositories. Auto-detect which commits to keep/drop when base branch was squash-merged into target. Use when: user says 'rebase', 'partial rebase', 'base already merged', 'smart rebase', or /smart-rebase. Not for: simple git rebase (the developer runs it — Claude never executes…
remind
A correction helper that checks which project rules or required steps were missed and loads the relevant guidance.
adr
Write an Architecture Decision Record (ADR) for a feature — Context / Decision / Status / Consequences / Alternatives, filed as docs/features/ /adr- - .md with a 3-digit zero-padded number. Handles the Superseded case: bidirectional linking when a new ADR replaces an old one. Use when: recording why an architectural…