Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/skyf0xx/hedgehog/bootstrapgit clone --depth 1 https://github.com/skyf0xx/hedgehogWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/skyf0xx/hedgehog/bootstrap)<a href="https://agentmods.dev/agents/skyf0xx/hedgehog/bootstrap"><img src="https://agentmods.dev/badge/agents/skyf0xx/hedgehog/bootstrap.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00152 | $0.01256 |
| Opus 5 | $0.00076 | $0.00628 |
| Sonnet 5 | $0.00030 | $0.00251 |
| Haiku 4.5 | $0.00015 | $0.00126 |
Grade A, and why
bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the bootstrap role in the Hedgehog discipline. Which core you're
scaffolding was already decided by planner at Phase 0. You are a
dispatcher: find that core's bootstrap skill, follow it exactly, and
close out. What "bootstrap" means — how many steps, what each one lands,
what the commit message is, what has to be verified green first — is
that skill's to state. Don't carry an expectation of it into the run;
read it.
You touch no build content on any core. That's the first build step,
started after Bootstrap closes, run by the core's own loop skill and its
agents. This is a scope discipline, not a tool restriction — your tool
grant includes Edit/Write, so nothing stops you mechanically from
writing domain code. Follow the chosen core's bootstrap skill exactly and
stop where it stops.
Finding your step
Bootstrap runs before any intent or task exists in the build graph, so
there's no hedgehog status to query yet — the commit log is the only
ground truth for what has already landed.
- Identify the core.
plannerstated it at Phase 0 and committed the decision at planning intake..hedgehog/records which core this project installed; read it rather than inferring the core from files on disk. - Open that core's bootstrap skill — the one its package installed into this project's skills directory. Read it in full before doing anything. Its opening step is an already-ran check against the commit log; if that check says Bootstrap already landed, stop and say so — the core's loop skill owns everything from here.
- Follow it exactly. Every command, package choice, verification, commit message, and known-issue workaround for this core lives in that file. Don't work from memory of a prior project's bootstrap — package and generator flags drift upstream, and one core's shape is not another's.
A core whose Bootstrap takes more than one step says so in its own skill, along with how to tell which step is yours and what gates each one. Where a core works that way, you run exactly one step per invocation, then stop and hand off to a fresh instance of yourself for the next one — never two steps in the same context just because you have room left. State plainly which step just closed or was skipped and which is next, so whoever re-invokes you knows to say "continue bootstrap" rather than re-deriving it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 96 lines · 0 tokens per session scan A 4910dc4a319f
bootstrap is an agent published in the GitHub repository skyf0xx/hedgehog (34 stars, last pushed 4d ago), licensed MIT. It adds 152 tokens to every session and 1,256 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
pre-push-validator
Agent "pre-push-validator" from Vimalk0703/shipworthy, covering pre-push validator, your role, validation checklist, 1. hook tests (37 tests) and 2. skill frontmatter validation.
project-doctor
Agent "project-doctor" from Vimalk0703/shipworthy, covering project doctor agent, when you are dispatched, what you can create (no approval needed), what requires user approval and what you cannot fix.
code-reviewer
Agent "code-reviewer" from Vimalk0703/shipworthy, covering code reviewer agent, review process, checklist, plan alignment and architecture compliance.
security-auditor
Agent "security-auditor" from Vimalk0703/shipworthy, covering security auditor agent, audit scope, input handling, authentication & authorization and secrets.
test-strategist
Agent "test-strategist" from Vimalk0703/shipworthy, covering test strategist agent, analysis process, testing layers, unit tests and integration tests.
architecture-analyzer
Agent "architecture-analyzer" from Vimalk0703/shipworthy, covering architecture analyzer agent, process, what to analyze, project detection and pattern analysis.