Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aaronjmars/aeon-agent/aeon)<a href="https://agentmods.dev/skills/aaronjmars/aeon-agent/aeon"><img src="https://agentmods.dev/badge/skills/aaronjmars/aeon-agent/aeon.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00147 | $0.08358 |
| Opus 5 | $0.00073 | $0.04179 |
| Sonnet 5 | $0.00029 | $0.01672 |
| Haiku 4.5 | $0.00015 | $0.00836 |
Grade E, and why
aeon scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
"What am I doing by hand over and over that Aeon could just do?" Mode 4 turns *this* chat into a skill; Mode 8 mines *past* chats to find which chat is worth turning into one. It reads the operator's local Claude Code tr Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- **"No MCP tools available."** On the Claude harness a single unresolved `${VAR}` in `.mcp.json` disables **every** MCP server for that run, not just the broken one (`::warning::.mcp.json references secret(s) not set:` Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf aeon.git && git clone https://github.com/<owner>/<name>.git && cd <name> Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
<curl / WebFetch / `./secretcurl` / `gh api` — how this skill fetches> This is a copy
100% identical to aeon — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 452 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Aeon
Aeon is an agent that runs on the user's own GitHub repo via Actions. A skill is a Markdown file (skills/<name>/SKILL.md); aeon.yml says which ones run and when.
Pick the mode they're asking for:
| 1 · Start | No instance yet, or set one up from scratch |
| 2 · Reschedule | Change times, cadence, or what a skill focuses on |
| 3 · Unblock | "It didn't run" / "nothing happened" |
| 4 · Chat → skill | Turn what we just did into a scheduled skill |
| 5 · Edit a skill | Change what an existing skill does |
| 6 · What to turn on | Pick skills, browse packs, install more |
| 7 · Strategy & voice | STRATEGY.md and soul/ — the north star and the tone |
| 8 · Mine history → skill | "What of my repeated work could Aeon do for me?" — surface it from past Claude Code chats |
Preflight (every mode)
-
Find the repo: current dir →
gh repo set-default→ ask. Clone it if it isn't local. -
Confirm
ghpoints at THEIR instance, before any command that writes.gh repo view --json nameWithOwner -q .nameWithOwnerIf that prints
aeonfun/aeonand they aren't working on upstream itself, stop and rungh repo set-default <owner>/<repo>.ghprefers anupstreamremote overoriginwhen no default is pinned, and every Aeon write (auth,secrets set,skills run, config pushes) is agh -R <resolved>call — so it will cheerfully put their API keys on the upstream repo and dispatch runs there. It looks like success: no error, a real run id, and the skill just never fires on their instance. -
gh auth status— everything routes throughgh. If it fails, tell them to rungh auth loginand stop. -
Use the
./aeonCLI for all config writes. It preserves comments inaeon.ymland validates. Never hand-edit the YAML — with one exception: the CLI cannot create an entry for a brand-new skill (see Mode 4 step 4).
Don't trust "disabled" for a skill you just created. The read path lists skills from disk and defaults a missing aeon.yml entry to enabled: false, so "not configured" and "disabled" look identical. One command tells them apart:
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +1 lines ee643687f351
- 6d ago First seen · 451 lines · 147 tokens per session scan E 3886dade499b
aeon is a skill published in the GitHub repository aaronjmars/aeon-agent (11 stars, last pushed yesterday), licensed MIT. It adds 147 tokens to every session and 8,358 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it E with 4 findings (reads agent configuration directories, reads mcp configuration, recursive force delete). It is 100% identical to aeon, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…