Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/acquia/acquia-skillsnpx agentmods add skills/acquia/acquia-skills/scriptingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/acquia/acquia-skills/scripting)<a href="https://agentmods.dev/skills/acquia/acquia-skills/scripting"><img src="https://agentmods.dev/badge/skills/acquia/acquia-skills/scripting/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/acquia/acquia-skills/scripting"><img src="https://agentmods.dev/badge/skills/acquia/acquia-skills/scripting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 134 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 161 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 296 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Excessive Agency · line 50 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 83 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 133 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 159 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 184 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 256 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.02017 |
| Opus 5.5 | $0.00011 | $0.00807 |
| Sonnet 5.5 | $0.00006 | $0.00403 |
| Haiku 4.5 | $0.00003 | $0.00202 |
Grade A, and why
scripting scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://github.com/acquia/cli/releases/latest/download/acli \ How it starts
The opening of the file, as written. The whole thing — 363 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scripting & Automation with Acquia CLI
Use when:
- Automating acli commands in shell scripts
- Integrating acli into CI/CD pipelines
- Running acli non-interactively
Use acli in scripts, CI/CD pipelines, and automation workflows to manage Acquia Cloud resources programmatically.
Non-Interactive Commands
All acli commands can run non-interactively by providing options. This is essential for scripts and CI/CD.
Basic pattern
# Interactive - prompts for missing information
acli ide:create
# Non-interactive - provides all info upfront
acli ide:create \
--application=abc123 \
--label="Automated IDE"
Common options
# No prompts - fails if info is missing
acli <command> --no-interaction
# Don't wait for async operations
acli <command> --no-wait
# Skip confirmations
acli <command> --yes
Simple Automation Examples
Example 1: Deploy on schedule
#!/bin/bash
# deploy.sh - Deploy to staging nightly
BRANCH="develop"
ENVIRONMENT="staging"
ENV_ID="<environment-id>"
acli api:environments:code-switch $ENV_ID $BRANCH
# Verify Drupal status
acli remote:drush status
MEO (V3) subscriptions: replace the
api:environments:code-switchline withacli api:v3:environments:create-deployment $ENV_ID true $BRANCH(see MEO Deployments). Likewise,acli remote:drush crhas an API-driven equivalent,acli api:v3:environments:clear-caches <environmentId> <domains>(see MEO Environments).
Run via cron:
# crontab -e
# Deploy every night at 2am
0 2 * * * /path/to/deploy.sh >> /tmp/deploy.log 2>&1
Example 2: Cache clearing workflow
#!/bin/bash
# cache-clear.sh - Clear caches across environments
set -e # Exit on any error
acli remote:drush cr
echo "Caches cleared!"
CI/CD Integration
GitHub Actions
Deploy on push to main:
# .github/workflows/deploy.yml
name: Deploy to Acquia
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Install acli
run: |
curl -fsSL https://github.com/acquia/cli/releases/latest/download/acli \
-o /usr/local/bin/acli
chmod +x /usr/local/bin/acli
- name: Authenticate
env:
ACQUIA_KEY: ${{ secrets.ACQUIA_KEY }}
ACQUIA_SECRET: ${{ secrets.ACQUIA_SECRET }}
run: |
mkdir -p ~/.acquia
cat > ~/.acquia/credentials.json <<EOF
{
"acquia-cloud-api": {
"key": "$ACQUIA_KEY",
"secret": "$ACQUIA_SECRET"
}
}
EOF
- name: Deploy to production
run: |
acli api:environments:code-switch ${{ vars.ACQUIA_PROD_ENV_ID }} main
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +6 lines 15071077db10
- 1mo ago First seen · 357 lines · 28 tokens per session scan A 793bceb51d1f
scripting is a skill published in the GitHub repository acquia/acquia-skills (10 stars, last pushed 7d ago), licensed MIT. It adds 28 tokens to every session and 2,017 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ci-cd-and-automation
Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.
google-cloud-slo-alert-configuration
Configures Cloud Monitoring PromQL-based Service Level Objective (SLO) alerting policies on Google Cloud for resources registered in App Hub or individually specified. Generates Terraform output. Use when the user asks to configure an SLO or Service Level Objective. Don't use for standard alerting policies.
cloud-build-basics
Teaches the fundamentals of Cloud Build on Google Cloud. Covers core concepts, API enablement, console navigation to the Build History page, and the end-to-end workflow for creating and manually running a basic build trigger. Do not use for managing private pools or complex pipeline architectures.
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
schedule-recipe
Turn 'run this every Friday at 4pm' into a working, copy-paste schedule on the user's actual runner. Use when asked to schedule a recurring AI task, set up a routine or cron job for a skill, automate a weekly report, or wire a skill into n8n or GitHub Actions. Produces the exact setup for the chosen runner plus the…
kotlin-tooling-gradle-to-kotlin-toolchain-project
Load when migrating or converting an entire Gradle Kotlin project (build.gradle(.kts), wrapper, libs.versions.toml, buildSrc) to the Kotlin Toolchain, including rewriting CI and replacing Gradle plugins that have no native Toolchain equivalent. Skip for porting one Gradle plugin or general Toolchain work once Gradle…