Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zakariaf/Flutter-Skills --skill seeded-determinism-and-golden-vectorsgit clone --depth 1 https://github.com/zakariaf/Flutter-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zakariaf/flutter-skills/seeded-determinism-and-golden-vectors)<a href="https://agentmods.dev/skills/zakariaf/flutter-skills/seeded-determinism-and-golden-vectors"><img src="https://agentmods.dev/badge/skills/zakariaf/flutter-skills/seeded-determinism-and-golden-vectors/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zakariaf/flutter-skills/seeded-determinism-and-golden-vectors"><img src="https://agentmods.dev/badge/skills/zakariaf/flutter-skills/seeded-determinism-and-golden-vectors.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00222 | $0.03455 |
| Opus 5 | $0.00111 | $0.01728 |
| Sonnet 5 | $0.00044 | $0.00691 |
| Haiku 4.5 | $0.00022 | $0.00346 |
Grade B, and why
seeded-determinism-and-golden-vectors scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks the agent to reveal its instructionsmediumSystem prompt leakage
Directions to print, repeat or translate the system prompt extract configuration the operator did not intend to expose.
version kept in the binary to reproduce everything before it. Never edit a shipped generator in How it starts
The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Seeded determinism and golden vectors
Some output must be a pure function of a key: the daily pick every user compares with their friends, a procedurally generated layout, a shareable result someone else can verify. It has to come out identical on every device, in every timezone, on the platform build you ship next year — with no server to arbitrate. That is a stronger property than "the tests pass", and it needs its own discipline plus a frozen oracle to keep it.
testing-strategy owns how you test pure logic (seeded fuzz against an independent oracle, injected
Clock). This skill owns what makes the output reproducible in the first place, and the committed
vector table that pins it.
A golden vector is not a golden image. Vectors are data fingerprints for a pure generator,
asserted by dart test with no widget binding; reference PNGs of rendered UI belong to
widget-golden-and-a11y-testing, and re-blessing them is the separate ritual in
run-goldens-rebaseline. The two share only the word "golden" and the rule that a gate must never
regenerate what it checks.
Non-negotiable rules
-
The key is injected, never read. A generator takes its key as an argument — a date string, an id, a sequence number. Nothing reachable from it calls
DateTime.now(). Wall-clock time enters the app exactly once, through the injectedClockat the composition root (value-objects-money-and-unitsowns that rule). WHY: a generator that reads a clock is untestable and un-golden-able, and its output cannot be reproduced from a bug report. -
A calendar-day key is a civil date, not an instant. "The 4th of July" is a date-only value — store and pass it as one (an ISO
YYYY-MM-DDstring or a day serial), never as aDateTimeinstant. An event timestamp is still a UTC instant; a day identity is not a moment in time at all. WHY: an instant makes every read timezone-dependent, so two devices disagree about which content is "today's".
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 232 lines · 222 tokens per session scan B 3fc7e084a101
seeded-determinism-and-golden-vectors is a skill published in the GitHub repository zakariaf/Flutter-Skills (2 stars, last pushed 14d ago), licensed MIT. It adds 222 tokens to every session and 3,455 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it B with 1 finding (asks the agent to reveal its instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
e2e-testing
Guide for running end-to-end tests of the Qwen Code CLI, including headless mode, MCP server testing, and API traffic inspection. Use this skill whenever you need to verify CLI behavior with real model calls, reproduce user-reported bugs end-to-end, test MCP tool integrations, or inspect raw API request/response…
terminal-capture
Automates terminal UI screenshot testing for CLI commands. Applies when reviewing PRs that affect CLI output, testing slash commands (/about, /context, /auth, /export), generating visual documentation, or when 'terminal screenshot', 'CLI test', 'visual test', or 'terminal-capture' is mentioned.
agent-reproduce-align
Use after a Codex or Claude Code feature has been implemented in Qwen Code to run the selected reference agent and Qwen Code under the same scenario, capture HTTP and terminal traces, compare request bodies, tool/function schemas, outputs, and iterate until the reproduced behavior is close enough.
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.