Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 0x0w1/jig --skill jig-updategit clone --depth 1 https://github.com/0x0w1/jigWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0x0w1/jig/jig-update)<a href="https://agentmods.dev/skills/0x0w1/jig/jig-update"><img src="https://agentmods.dev/badge/skills/0x0w1/jig/jig-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.04108 |
| Opus 5 | $0.00025 | $0.02054 |
| Sonnet 5 | $0.00010 | $0.00822 |
| Haiku 4.5 | $0.00005 | $0.00411 |
Grade D, and why
jig-update scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- `curl -fsSL https://raw.githubusercontent.com/0x0w1/jig/main/install.sh | sh -s -- --target <target> --scope <project|global> --version <latest> --skills <that instance's stamped skills>` Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
| Claude Code | user | `jig@jig` enabled in `~/.claude/settings.json` | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Fallback without `gh`: `curl -fsSL https://api.github.com/repos/0x0w1/jig/releases/latest` and read `tag_name`. How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
jig Update
Use this repository skill to update the installed jig procedures to the latest release.
Update Model
Installation remains target-specific, but one jig-update run updates every jig installation detected in the current project and on the local user account. The agent that invoked the skill does not limit the update set: running /jig:jig-update from Claude Code must also refresh Codex or Antigravity installations found in the same project or user environment.
- Treat each target and scope as a separate installation instance. Inventory all instances before deciding that jig is current, and never stop because only the invoking target is current.
- Claude Code plugin is the current installation model. Update every installed plugin scope with
claude plugin update jig@jig --scope <scope>. Plugin skills are namespaced as/jig:<skill>and have no jig version stamp. - Claude Code standalone skills are a supported update-compatibility surface for installations that already exist under
.claude/skillsor~/.claude/skills. Do not create a new standalone installation. Preserve the exact selection and directory naming recorded in.jig-installation; for a legacy installation with no ledger, admit only directories whose frontmatter name and canonical payload title both match, then create the ledger and per-skill.jig-provenancemarkers after a successful update. - Codex and Antigravity have no plugin system. Their
jig-prefixed skill directories under.agents/skillsare refreshed by re-runninginstall.shonce per target, pinned to the latest tag. The installer is idempotent: unchanged files pass, changed files are backed up as*.bak, and managed blocks are replaced in place. - A skill is a directory, not always one
SKILL.md. The installer readsdist/files.tsvfrom the pinned version and installs every file that skill ships, such as the rubric catalog underjig-version-rubric/rubrics. Files an older version installed and the new payload no longer lists stay on disk; report them and remove them only with explicit confirmation. - For codex and antigravity, the installed version and skill selection are stamped inside the jig managed block as
<!-- jig:version vX.Y.Z skills=<a,b,c> -->inAGENTS.mdorGEMINI.md. A stamp withoutskills=means the full default skill set. - A successfully updated standalone root records
version,target,scope, and its exact<manifest skill>=<directory name>selection in<root>/.jig-installation. Read this ledger when computing its release and migration range. A legacy root without it has an unknown version until its first successful update. - The latest version is the latest GitHub release tag of
0x0w1/jig. - Repository-side convergence (branch protection, legacy file and label cleanup) is handled by the
github-syncskill after the update, and is idempotent across skipped versions. .jig/is owned by the project, not by the installer. The version rubric at.jig/versioning.mdis never written, replaced, or removed by an update;version-rubricowns it.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 144 lines · 50 tokens per session scan D 5fc34202c2d2
jig-update is a skill published in the GitHub repository 0x0w1/jig (5 stars, last pushed 4d ago), licensed MIT. It adds 50 tokens to every session and 4,108 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
article-writing
Write articles, guides, blog posts, tutorials, newsletter issues, and other long-form content in a distinctive voice derived from supplied examples or brand guidance. Use when the user wants polished written content longer than a paragraph, especially when voice consistency, structure, and credibility matter.
haiku
When writing a haiku for this bot, follow these conventions.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
taiyi-ui-design
A design-planning guide for describing how an application's user interface should look and behave. It produces a UI-DESIGN.md document covering layouts, components, interactions, accessibility, and error states.
ln-62-repository-publisher
Commits, pushes, and remotely verifies authorized repository changes. Not for releases, package publication, or announcements.
remove
Remove a deployed framework or addon from the current workspace.