Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/evol-ai/skillcompass/skill-reportgit clone --depth 1 https://github.com/Evol-ai/SkillCompassWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.03109 |
| Opus 5 | $0.00000 | $0.01554 |
| Sonnet 5 | $0.00000 | $0.00622 |
| Haiku 4.5 | $0.00000 | $0.00311 |
Grade A, and why
skill-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/skill-report — Skill Portfolio Report
Generate a comprehensive report of all installed skills: quick health scan, context budget, portfolio overview, and quality summary.
Arguments
--skip-scan: Skip Quick Health Scan, only show Parts 2-4--scan-only: Only show Quick Health Scan (Part 1)
Steps
Step 1: Load Skill Inventory
Use the Read tool to load .skill-compass/setup-state.json. If the file does not exist, run /setup first and then continue from Step 2.
Extract the skill list from the inventory array. Each entry provides: name, path, version, purpose (category), modified_at. Keep the full list in memory.
If inventory is empty or missing, output:
No skills found in inventory. Run /setup to discover installed skills.
Then stop.
Step 2: Quick Health Scan (D1+D2+D3)
Skip this step entirely if --skip-scan was passed.
Build a skillEntries array from the inventory: [{ name, path, modified_at }, ...].
Run the QuickScanner using the Bash tool:
const { QuickScanner } = require('./lib/quick-scan');
const scanner = new QuickScanner('cc');
const skillEntries = /* array from inventory */;
const { results, summary } = scanner.scanAll(skillEntries);
Execute with node -e passing the constructed skillEntries inline, for example:
node -e "
const { QuickScanner } = require('./lib/quick-scan');
const scanner = new QuickScanner('cc');
const entries = {ENTRIES_JSON};
const out = scanner.scanAll(entries);
console.log(JSON.stringify(out));
"
Replace {ENTRIES_JSON} with the actual JSON array. Run this from the SkillCompass base directory ({baseDir}).
Sort results: high_risk first, then medium, then clean. Within each group, sort alphabetically by skill_name.
For skills that are disabled (check InboxStore.getSkillCache(name)?.disabled) or have ever_used === false from UsageReader.getSignals(name), mark them with verdict never_used for display purposes (use the ○ symbol).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 303 lines · 0 tokens per session scan A 953ec32b2d6f
skill-report is a command published in the GitHub repository Evol-ai/SkillCompass (215 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,109 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
thread
Manage conversation threads (create, switch, update, delete, show).
audit_docs
Audit all project metadata files for stale counts, version mismatches, broken references, and missing entries. Reports discrepancies without auto-fixing.
pr
Create a feature branch, commit staged/unstaged changes, push, and open a GitHub PR against main — use when you have local changes not yet on any branch and want a reviewable PR. Distinct from /ship (commit + push to current branch, no PR) and /fixpr (resolve conflicts or run quality gates on an existing PR).
compile_paper
Convert a SWARM paper from markdown to LaTeX (if needed), compile to PDF, and open it.
submit_to_list
Fork an external GitHub repo, add an entry to a curated list (e.g. awesome-), and open a PR — all via gh CLI.
add_scenario
Scaffold a new YAML scenario config with SWARM conventions — use when testing a new governance configuration or agent motif that uses existing domain infrastructure. Distinct from /adddomain (new task category requiring new data models and handlers) and /addmetric (new measurement on existing data).