Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Sagargupta16/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/sagargupta16/claude-skills/renovate-triage)<a href="https://agentmods.dev/plugins/sagargupta16/claude-skills/renovate-triage"><img src="https://agentmods.dev/badge/plugins/sagargupta16/claude-skills/renovate-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/sagargupta16/claude-skills/renovate-triage"><img src="https://agentmods.dev/badge/plugins/sagargupta16/claude-skills/renovate-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
renovate-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "renovate-triage",
"description": "Triage open Renovate PRs across your repos into merge / close / defer. Inlines live GitHub state via dynamic context injection.",
"version": "1.0.0"
}
What it installs
The manifest is a name and a version. 1 skill travel with it, and installing the plugin installs all of them — 62 tokens a session between them. Each is measured on its own page, and each can be installed alone.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 6 lines scan A 5b4458c38511
renovate-triage is a plugin published in the GitHub repository Sagargupta16/claude-skills (5 stars, last pushed 5d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
contributor-writing
Writing skills for Shopware core contributors: Architecture Decision Records, PR descriptions (trunk and feature-branch formats), commit messages, and RELEASEINFO/UPGRADE entries. Analyzes branch diffs, classifies changes, and writes content calibrated to change magnitude.
code-contribution-analysis
Skills for analyzing GitHub pull requests and issues in depth. Fetches contribution data from GitHub and researches architectural context via chunkhound-integration. Standalone useful for code review, and designed to be consumable by Claude Agent SDK applications.
guardrails
Fourteen safety guards that block secret/credential writes, hardcoded machine-specific paths, git hook-bypass attempts, irreversible git operations (force-push, reset --hard, worktree-wide checkout/restore discards), Bash file-write workarounds that circumvent Write/Edit hooks, Windows drive-root /tmp writes (POSIX…
github
GitHub admin-plane audit, advice, and guided setup over the authenticated user's own gh CLI: billing and cost control, security posture, rulesets and settings drift, Actions policy, and every other org/repo/enterprise settings area. Grounded in live state and current official GitHub docs (zero vendored knowledge)…
repo-hygiene
Repo hygiene action-router: /repo-hygiene:clean sweeps reclaimable caches, build artifacts, and stale git metadata, and can realign the working tree to a fresh-pull state, dry-run-first, with destructive tiers gated behind explicit confirmation and a session-scoped destructive-command guard. Ecosystem targets are…
repo-fleet-hygiene
Cross-repository Git/GitHub fleet discovery, evidence rollup, and a gated apply verb that executes a prior fleet action plan behind one confirmation. Audit stays read-only and confidence-tiered; apply mutates only with --apply plus interactive confirmation or --yes.