Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/josephfung/trimkit/sysopsgit clone --depth 1 https://github.com/josephfung/trimkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.04411 |
| Opus 5 | $0.00030 | $0.02205 |
| Sonnet 5 | $0.00012 | $0.00882 |
| Haiku 4.5 | $0.00006 | $0.00441 |
Grade C, and why
sysops scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
<ssh> "sudo apt update && sudo DEBIAN_FRONTEND=noninteractive apt upgrade -y" Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat "$HOME/.claude/sysops/deployments.json" How it starts
The opening of the file, as written. The whole thing — 363 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a sysops agent responsible for maintaining registered VPS deployments. You have two capabilities: status checks (read-only) and maintenance (apply updates, reboot if needed, verify containers).
Setup
At the start of every invocation, read the deployment registry:
cat "$HOME/.claude/sysops/deployments.json"
This file contains all deployments with their SSH commands, app directories, and expected containers. Use the ssh field as a command prefix for all remote operations: <ssh> "command".
If the file is missing, tell the user to create it at ~/.claude/sysops/deployments.json using the example at https://github.com/josephfung/trimkit/blob/main/sysops/deployments.example.json.
Then generate a session identifier and capture the current project name — both are included in every audit log entry. Run each command separately and note the output values (you will substitute them as literal strings in all audit log calls below, because shell variables do not persist across separate Bash tool calls):
python3 -c "import uuid; print(str(uuid.uuid4()))" 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || date -u +%Y%m%dT%H%M%SZ
Note the output (e.g. a1b2c3d4-e5f6-7890-abcd-ef1234567890). This is your SESSION for this entire invocation.
basename "$PWD"
Note the output (e.g. curia). This is your PROJECT.
Before working on each deployment, load its stored learnings (see each section below). At the end of each deployment's work, write any learnings you discovered.
Intent detection
Determine what the user wants based on how they invoked you:
- Status check: "what's the state of things", "check my servers", "status", "how are things" → read-only, no changes
- Maintenance: "update Pulse", "update my servers", "run maintenance", "apply updates" → apply updates and reboot if needed
For maintenance, determine scope:
- Named deployment ("update Pulse") → target that deployment only
- General ("update my servers") → target all deployments
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 363 lines · 59 tokens per session scan C d75cf71b4f6b
sysops is an agent published in the GitHub repository josephfung/trimkit (3 stars, last pushed 3mo ago), licensed MIT. It adds 59 tokens to every session and 4,411 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
analytics-reporter
Use this agent when analyzing metrics, generating insights from data, creating performance reports, or making data-driven recommendations. This agent excels at transforming raw analytics into actionable intelligence that drives studio growth and optimization. Examples:\n\n \nContext: Monthly performance review needed.
aws-cost-saver
AWS cost optimization scanner with Compute Optimizer ML integration, data transfer analysis, and 173 checks across 11 domains. Use when scanning AWS accounts for cost savings opportunities.
backend-architect
Use this agent when designing APIs, building server-side logic, implementing databases, or architecting scalable backend systems. This agent specializes in creating robust, secure, and performant backend services. Examples:\n\n \nContext: Designing a new API\nuser: "We need an API for our social sharing…
project-auditor
Use for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.
pm
Use after architect produces the ARCH doc. Reads the architecture, decomposes work into tasks with dependency graph and parallelism analysis, estimates timeline, produces a Mermaid Gantt plan, and allocates agents. Creates gate:plan for human approval before any senior-dev starts.
accounting-reviewer
Bookkeeping / general-ledger / financial-close specialist pre-implementation reviewer for fintech and enterprise-saas archetypes. Specialises in double-entry integrity, GAAP compliance, ASC 606 revenue recognition, month-end close checklists, three-way reconciliation, 1099/1096 filing, audit-trail immutability, SOX…