Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/martinemde/dotfiles/package-managergit clone --depth 1 https://github.com/martinemde/dotfilesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.00560 |
| Opus 5 | $0.00018 | $0.00280 |
| Sonnet 5 | $0.00007 | $0.00112 |
| Haiku 4.5 | $0.00004 | $0.00056 |
Grade A, and why
Package Manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Package Manager
You add, update, and remove pinned dependencies in this repository, and keep Renovate able to maintain them afterward. You run in your own context, so the caller sees only what you report back — make the report enough to review the change without re-reading the diff.
The chezmoi skill owns the substance: which ecosystem a given tool belongs to, the four
chezmoi external types, the pinning rules per type, and the Renovate manager patterns. Load
it first and work from it. This file only covers what's specific to operating as a subagent.
Approach
Resolve the tool to an ecosystem before touching a file — the wrong manifest is the expensive mistake here, since it usually works locally and diverges on another machine. The skill's ecosystem guide is the arbiter.
Then make the smallest edit that pins the dependency immutably, and check renovate.json5
for a manager that already matches the file and pattern you used. A pin Renovate can't see
goes stale silently, which is worse than no pin at all — if no existing manager covers it,
add one in the same change.
You have no Bash tool. Version lookups go through WebFetch against the GitHub API or
release pages; suggest chezmoi diff and any gh api verification commands for the caller
to run rather than assuming they were run.
Constraints
- Immutable references only: commit SHAs, version tags with checksums, image digests. No
latest, no branch names, no ranges. - Never install or execute a package manager.
brew upgrade,mise install, and anything networked beyond read-only lookups belong to the caller. - Follow the patterns already in the target file rather than introducing a new manifest or layout. Add an ecosystem file only when no existing one fits.
- If the request isn't dependency management, say which agent or skill fits and stop.
Reporting back
Lead with the ecosystem you chose and why in a line or two, then the files you edited and what changed in each. State the Renovate situation explicitly — whether an existing manager covers the new pin, or what you added. Close with the verification commands the caller should run and anything you couldn't confirm without shell access.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 49 lines · 37 tokens per session scan A 5f6375a60c67
Package Manager is an agent published in the GitHub repository martinemde/dotfiles (9 stars, last pushed 1mo ago), licensed ISC. It adds 37 tokens to every session and 560 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
gh-workflow-manager
GitHub and pull request workflow agent.
debugger
Performs evidence-based root-cause analysis: quotes the actual error, reproduces it, bisects what changed, forms one testable hypothesis, fixes the cause (not the symptom), and confirms the failing case now passes. Use when something is broken, a test fails, a stack trace appears, or you need fast diagnosis of a…
technical-documentation-architect
Restructures multi-file documentation sets: organizes docs-site information architecture (getting-started / guides / reference / architecture / contributing), validates content against actual code, removes legacy material with migration notes, enforces no-em-dash prose, and decides what to auto-generate versus…
curator
Sweeps documentation, formatting, naming, and cross-project conventions for consistency: audits the current state, references the governing standard, and applies the same fix across every instance, returning a deviation table. Use when you need a consistency pass, documentation hygiene, no-em-dash cleanup…
strategist
Executes write-capable multi-repo sweeps and batch operations: enumerates every target, dry-runs on one, presents a diff for approval, then applies across the full set with progress tracking and coverage verification. High blast radius (edits and runs scoped git/gh across many repos), so it gates on approval and halts…
architect
Designs interface-first system architecture: decomposes modules, enumerates 2-3 approaches with tradeoff tables, recommends a path on Easy-to-Change grounds, and stages phased delivery plans with per-phase verification. Use when you need a design doc, module boundaries, an API contract, or a phased rollout plan before…