dora

dora is a command for Claude Code from nitinjain999/platform-skills. It costs 97 tokens per session (2,329 once invoked), scanned B, original, Apache-2.0.

A command for measuring software delivery performance with DORA metrics: deployment frequency, lead time for changes, change failure rate, and mean time to recovery. It covers collecting these events from GitHub Actions and displaying them with Prometheus and Grafana.

In plain words
What is it for?
Use it to instrument GitHub Actions, record deployments and incidents, send measurements to Prometheus Pushgateway, create recording rules and Grafana dashboards, and compare engineering performance over time.
Why use it?
It turns build, deployment, and incident events into consistent measurements, making delivery slowdowns and failures easier to investigate.

Command for Claude Code

Written for Claude Code: argument-hint in frontmatter.

Part of the platform-skills plugin — 1 skill, 43 commands shipped together

Good fit Use it to instrument GitHub Actions, record deployments and incidents, send measurements to Prometheus Pushgateway, create recording rules and Grafana dashboards, and compare engineering performance over time.

Compare 6 commands from other repositories ↓
Install with agentmods
npx agentmods add commands/nitinjain999/platform-skills/dora
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/nitinjain999/platform-skills

Made for: Claude Code.

Or install platform-skills, the plugin that ships this one along with the rest of its 1 skill, 43 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dora

README.md
[![agentmods](https://agentmods.dev/badge/commands/nitinjain999/platform-skills/dora.svg)](https://agentmods.dev/commands/nitinjain999/platform-skills/dora)
Your own site
<a href="https://agentmods.dev/commands/nitinjain999/platform-skills/dora"><img src="https://agentmods.dev/badge/commands/nitinjain999/platform-skills/dora.svg" alt="Measured on agentmods" height="20"></a>
Per session 97 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,329 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00097 $0.02329
Opus 5 $0.00048 $0.01164
Sonnet 5 $0.00019 $0.00466
Haiku 4.5 $0.00010 $0.00233

Measured 8d ago against content hash 41aa145b3f1f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade B, and why

dora scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

cat <<EOF | curl --data-binary @- "${PUSHGATEWAY_URL}/metrics/job/dora/instance/${INSTANCE}"

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

cat <<EOF | curl --data-binary @- "${PUSHGATEWAY_URL}/metrics/job/dora/instance/${INSTANCE}"
commands/dora.md · 193 lines

How it starts

The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Measure, benchmark, and instrument DORA metrics for production engineering teams.

Mode: instrument

Add DORA event emission to a GitHub Actions workflow.

Steps:

  1. Identify which events to capture:

    • Deploy event: triggered on successful deployment to a target environment
    • Incident open event: triggered by PagerDuty/OpsGenie webhook when an incident is created
    • Incident close event: triggered when the incident is resolved
  2. Detect: does a Prometheus Pushgateway exist in the stack? If not, it must be deployed before instrumentation can work:

    kubectl get svc -A | grep pushgateway
    

    If absent, deploy via Helm before proceeding:

    helm upgrade --install prometheus-pushgateway prometheus-community/prometheus-pushgateway \
      --namespace monitoring \
      --create-namespace
    
  3. Generate GitHub Actions steps for each event type:

    • Deploy event: push dora_deployment_timestamp and dora_lead_time_seconds to Pushgateway
    • Incident triggered (PagerDuty/OpsGenie webhook): push dora_incident_start_timestamp
    • Incident resolved: push dora_incident_duration_seconds and dora_incident_caused_by_deploy
  4. Output: exact YAML to append to the existing workflow, using the Pushgateway job name convention job/dora/instance/<repo-owner_repo-name>. Sanitize owner/repoowner_repo to avoid breaking Pushgateway path segments.

    Example deploy event step:

    - name: Push DORA deploy metrics
      if: success()
      env:
        PUSHGATEWAY_URL: ${{ secrets.PUSHGATEWAY_URL }}
        REPO: ${{ github.repository }}
      run: |
        DEPLOY_TS=$(date +%s)
        # Lead time from first commit in this batch — requires fetch-depth: 0 in checkout.
        FIRST_COMMIT_TS=$(git log --reverse --format="%ct" origin/main..HEAD | head -1)
        FIRST_COMMIT_TS=${FIRST_COMMIT_TS:-$DEPLOY_TS}
        LEAD_TIME=$((DEPLOY_TS - FIRST_COMMIT_TS))
        INSTANCE="${REPO//\//_}"
        cat <<EOF | curl --data-binary @- "${PUSHGATEWAY_URL}/metrics/job/dora/instance/${INSTANCE}"
        # TYPE dora_deployment_timestamp gauge
        dora_deployment_timestamp{repo="${REPO}",env="production"} ${DEPLOY_TS}
        # TYPE dora_lead_time_seconds gauge
        dora_lead_time_seconds{repo="${REPO}",env="production"} ${LEAD_TIME}
        EOF
    
  5. Warn: Change Failure Rate requires incident source integration — a rate of 0% without incident data is a configuration gap, not a real metric. Never report 0% CFR without confirmed incident source connectivity.

Validation:

# Confirm Pushgateway received the metric
curl -s http://pushgateway:9091/metrics | grep dora_deployment_timestamp

# Confirm Prometheus scraped it (allow up to 1 scrape interval, default 15s)
curl -s 'http://prometheus:9090/api/v1/query?query=dora_deployment_timestamp' \
  | jq '.data.result[0].value[1] // "not yet scraped — wait 15s and retry"'

Reference: references/dora.md → Open-source instrumentation pattern

Read the full file on GitHub · 193 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 193 lines · 97 tokens per session scan B 41aa145b3f1f

Subscribe to this mod's changes

dora is a command published in the GitHub repository nitinjain999/platform-skills (41 stars, last pushed today), licensed Apache-2.0. It adds 97 tokens to every session and 2,329 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.