Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wayne930242/straw-boss/work-onnpx skills add wayne930242/straw-boss --skill work-ongit clone --depth 1 https://github.com/wayne930242/straw-bossWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wayne930242/straw-boss/work-on)<a href="https://agentmods.dev/skills/wayne930242/straw-boss/work-on"><img src="https://agentmods.dev/badge/skills/wayne930242/straw-boss/work-on.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.01632 |
| Opus 5 | $0.00039 | $0.00816 |
| Sonnet 5 | $0.00015 | $0.00326 |
| Haiku 4.5 | $0.00008 | $0.00163 |
Grade A, and why
work-on scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
See docs/roles.md for the cast of characters and the authority framework this skill operates under — not redefined here.
App resolution: identify the checkout and return it to the caller. The caller's chosen coordination graph decides whether the current agent works there or opens a separate app-rooted workroom.
An agent working in the app loads its own instructions before acting. A separate workroom is useful when the caller needs the app's full session harness or a durable interactive lifecycle.
Locate the config with git rev-parse --show-toplevel from the current working directory, then read <repo-root>/.claude/straw-boss/apps.json — never assume the current directory is the repo root, and never search upward by hand.
If it doesn't exist, that's not a hard stop — init is a convenience, not a precondition. See Task 1's no-config handling below.
Task 1: Resolve the target app
No apps.json at all: don't block on this — check whether the repo itself reads as single-app (no apps//packages//services/-style directory holding more than one independent codebase at the repo root). If it does, treat the repo root itself as the one implicit app — name it from its package.json (or equivalent manifest) or, failing that, the repo root's own directory basename; dir is the repo root. Proceed with the rest of this skill exactly as if that were the sole apps.json entry. Mention once, briefly, that running init is available if they want to customize git-lifecycle behavior, local-only files, etc. — but never require it first. If the repo structure genuinely looks like a monorepo instead (more than one plausible app directory) and there's no config to say which is which, that's real ambiguity, not something to guess through — ask the user which directory this specific request targets, or suggest init if they'd rather configure it once than get asked every time.
Exactly one non-redirect app configured: use it as the target unless the request is explicitly outside that app, such as infrastructure owned elsewhere or a self-contained external lookup. In that case, return the out-of-scope classification to the caller. Otherwise skip matching and proceed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 78 lines · 77 tokens per session scan A ba0c8b03b4d7
work-on is a skill published in the GitHub repository wayne930242/straw-boss (3 stars, last pushed yesterday), licensed MIT. It adds 77 tokens to every session and 1,632 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
codex-setup
Initialize sd0x-dev-flow infrastructure for Codex CLI and other non-Claude agents. Generates AGENTS.md, installs the commit-msg hook, copies runner scripts. The pre-push gate is opt-in via --with-push-gate. Use when setting up a new project or after updating skills.
create-request
Create, update, or scan per-task request tickets for progress tracking. These are date-prefixed non-lifecycle docs under requests/, NOT feature-level requirements (use /req-analyze for those). Use when: tracking task progress, updating completion status, scanning incomplete requests, checking request status dashboard.…
codex-code-review
Code review using Codex exec. Use when: PR review, code audit, second opinion on changes. Not for: doc review (use doc-review), security audit (use security-review). Output: severity-grouped findings + merge gate.
codex-implement
Implement features via Codex exec. Use when: writing new code from specs, implementing features, Codex-driven development. Not for: code review (use codex-code-review), architecture advice (use codex-architect). Output: implemented code + review loop.
smart-rebase
Smart partial rebase for squash-merge repositories. Auto-detect which commits to keep/drop when base branch was squash-merged into target. Use when: user says 'rebase', 'partial rebase', 'base already merged', 'smart rebase', or /smart-rebase. Not for: simple git rebase (the developer runs it — Claude never executes…