Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add waynesutton/convexskills --skill avoid-feature-creepgit clone --depth 1 https://github.com/waynesutton/convexskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/waynesutton/convexskills/avoid-feature-creep)<a href="https://agentmods.dev/skills/waynesutton/convexskills/avoid-feature-creep"><img src="https://agentmods.dev/badge/skills/waynesutton/convexskills/avoid-feature-creep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/waynesutton/convexskills/avoid-feature-creep"><img src="https://agentmods.dev/badge/skills/waynesutton/convexskills/avoid-feature-creep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02488 |
| Opus 5 | $0.00032 | $0.01244 |
| Sonnet 5 | $0.00013 | $0.00498 |
| Haiku 4.5 | $0.00006 | $0.00249 |
Grade A, and why
avoid-feature-creep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
3 near-identical copies found in the catalogue:
- avoid-feature-creep — 100% identical, 0 lines differ
- avoid-feature-creep — 100% identical, 0 lines differ
- avoid-feature-creep — 97% identical, 4 lines differ
How it starts
The opening of the file, as written. The whole thing — 308 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Avoid Feature Creep for Agents
Stop building features nobody needs. This skill helps you ship products that solve real problems without drowning in unnecessary complexity.
Feature creep kills products. It delays launches, burns budgets, exhausts teams, and creates software nobody wants to use. The most successful products do fewer things well.
The Core Problem
Feature creep is the gradual accumulation of features beyond what your product needs to deliver value. It happens slowly, then all at once.
Warning signs you're in trouble:
- Release scope keeps growing without clear user value
- You're copying competitor features without validating need
- Stakeholders keep adding "just one more thing"
- The codebase is getting harder to maintain
- Users complain the product is confusing or bloated
- You haven't shipped in months
What it costs:
- Development time on features 80% of users never touch
- Increased bug surface area
- Team burnout and context switching
- Delayed time-to-market
- Technical debt that compounds
- User confusion and abandonment
Decision Framework
Before adding ANY feature, run through this checklist:
1. VALIDATE THE PROBLEM
□ Does this solve a real, validated user pain point?
□ Have we talked to actual users about this need?
□ What evidence supports building this?
2. CHECK ALIGNMENT
□ Does this support the core product vision?
□ Would this delay our current release?
□ What are we NOT building if we build this?
3. MEASURE IMPACT
□ How will we know if this feature succeeds?
□ What KPIs will change?
□ Can we quantify the value (time saved, revenue, retention)?
4. ASSESS COMPLEXITY
□ What's the true cost (build + test + maintain + document)?
□ Does this add dependencies or technical debt?
□ Can we ship a simpler version first?
5. FINAL GUT CHECK
□ Would we delay launch by a month for this feature?
□ Is this a differentiator or just table stakes?
□ Would removing this harm the core experience?
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 308 lines · 65 tokens per session scan A cb3f7f647713
avoid-feature-creep is a skill published in the GitHub repository waynesutton/convexskills (404 stars, last pushed 7mo ago), licensed Apache-2.0. It adds 65 tokens to every session and 2,488 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sc-cf
Cloudflare DNS automation — idempotent per-record A/AAAA/CNAME/TXT writes via the Cloudflare v4 API, DNS-only (grey cloud) by default so Let's Encrypt works. Use this provider whenever the domain's nameservers actually delegate to Cloudflare; it mirrors the lib/hostinger.js contract so /sc-all can swap providers.…
sc-all
Turn a plain-language web-app goal into a working live app. Designed for non-technical users: choose architecture and hosting automatically, connect accounts safely, create/publish code, data, domain and verification end-to-end, delegate user-facing frontend quality to sc-fe, and expose technical details only when…
sc-onboarding
Onboard SI-Coder provider access safely. Fresh local setup resolves a user, creates named provider connections, and stores direct credentials only in 0600 connection files; OAuth stays external. Legacy profile//.bashrc tooling is migration-only. Agents route through /sc-provider so plaintext secrets never enter…
use-si-coder
Legacy one-shot full-stack auto-deploy monolith. Runs scripts/deploy.js to create a GitHub repo, push local code via SSH, set up a Dokploy project, configure self-hosted Convex (Docker Compose) + Next.js, wire Hostinger DNS, and trigger + poll the deployment — zero human steps. Superseded by the modular /sc- skills…
sc-provider
SI-Coder provider + connection control plane for humans and agents. Manage user-scoped labeled provider connections, auth methods/scopes, custom provider metadata, secret-safe credential status/handoffs, injected execution, audits, and safe updates without putting provider secrets in chat/tool JSON.
sc-git
GitHub repo CRUD + Actions cost reduction. Audit workflow burn rate, disable noisy YAML (workflowdispatch-only with backup), run CI locally instead of cloud minutes, install pre-push hook, install self-hosted runner at VPS, POST commit statuses, register VPS crontab. Replaces GitHub Actions cloud minutes with…