Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wellwelwel/lagune/engineeringnpx skills add wellwelwel/lagune --skill engineeringgit clone --depth 1 https://github.com/wellwelwel/laguneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wellwelwel/lagune/engineering)<a href="https://agentmods.dev/skills/wellwelwel/lagune/engineering"><img src="https://agentmods.dev/badge/skills/wellwelwel/lagune/engineering.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00051 | $0.01504 |
| Opus 5 | $0.00026 | $0.00752 |
| Sonnet 5 | $0.00010 | $0.00301 |
| Haiku 4.5 | $0.00005 | $0.00150 |
Grade A, and why
engineering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lagune engineering
This skill is the specialized, authoritative description of how Lagune is built: the toolchain, code conventions, type rules, the build and distribution path, and the implementation of the deterministic tracking hooks. Consult it before writing or changing source, before touching the build, and whenever you apply the code conventions.
The product mission and workflow philosophy live in CLAUDE.md. The repository layout, the command/template split, the core/adapter boundary, what Lagune scaffolds, and the tracking-map model live in the architecture skill. This skill covers the build, not the shape.
Toolchain
- Runtimes: Node.js (current LTS), Bun, and Deno. Lagune must run on all three, so keep code runtime-agnostic.
- Language: TypeScript, authored in
src/. - Module system: ES Modules only (ESM) throughout.
- Package manager: npm, matching the npx/npm distribution path.
- Bundler: esbuild (transpile and bundle only, it does not type-check).
- Type-checking:
tsc --noEmit, run separately since esbuild skips type checks. - Tests: Poku, run against each runtime: Node (
npm test), Bun (bun run test:bun), and Deno (deno task test:deno).
Code conventions
General
- Arrow functions over
function. Declare withconst. Use afunctiononly when thethiscontext strictly requires it. - Named exports only. Never use
default export. - Practice early return. Handle edge cases up front and exit, rather than nesting the main logic.
- No abbreviations. Names are clear and explicit (for example
left/right, nota/b, andindex, noti). - Avoid nested
if-else-else-if. Favor clean, well-decoupled approaches when branching grows. - No duplicated logic or types. Reuse existing logic and types whenever it is viable.
- No side effects inside loops or iterations. Keep iteration pure.
- Prefer native capabilities over external dependencies whenever possible.
- Always prefix native imports with
node:(for examplenode:path,node:fs). - Prefer the async Node.js APIs when viable (for example
node:fs/promises).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 61 lines · 51 tokens per session scan A 8b2fc7ff8bf8
engineering is a skill published in the GitHub repository wellwelwel/lagune (140 stars, last pushed 5d ago), licensed MIT. It adds 51 tokens to every session and 1,504 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
firebase-messaging
Use when setting up Firebase Cloud Messaging, managing permissions and tokens, handling background/foreground notification taps, or dispatching messages server-side (HTTP v1).
firebase-cloud-functions
Use when calling callable functions (httpsCallable), passing data to server-side logic, handling function errors/timeouts, configuring regions, or testing with the Emulator Suite.
023-assumption-analysis
Use when a framed and root-caused problem needs its assumptions made explicit before design or planning begins — explicit Assumptions, Unknowns, and a Validation plan. This should trigger when an issue's Assumption Analysis point of view needs evaluation, or when a maintainer directly asks to surface hidden…
sanity-best-practices
Sanity development best practices for schema design, GROQ queries, TypeGen, Visual Editing, images, Portable Text, Studio structure, localization, migrations, Sanity Functions, webhooks, Blueprints, and framework integrations such as Next.js, Nuxt, Astro, Remix, SvelteKit, Angular, Hydrogen, and the App SDK. Use this…
building-soc-metrics-and-kpi-tracking
Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level…
configuring-identity-aware-proxy-with-google-iap
Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.