Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AdamBien/airails --skill zllm-scriptsgit clone --depth 1 https://github.com/AdamBien/airailsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adambien/airails/zllm-scripts)<a href="https://agentmods.dev/skills/adambien/airails/zllm-scripts"><img src="https://agentmods.dev/badge/skills/adambien/airails/zllm-scripts/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adambien/airails/zllm-scripts"><img src="https://agentmods.dev/badge/skills/adambien/airails/zllm-scripts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00241 | $0.01914 |
| Opus 5.5 | $0.00096 | $0.00766 |
| Sonnet 5.5 | $0.00048 | $0.00383 |
| Haiku 4.5 | $0.00024 | $0.00191 |
Grade C, and why
zllm-scripts scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
OS commands have no limits: `cat ~/.ssh/id_rsa`, `grep -r token /`, or `find /` with megabytes of output. The zllm-scripts can't do any of that: How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Perform the file and clipboard steps of $ARGUMENTS with the zllm-scripts commands instead of OS shell commands. Apply all rules below.
- Source: https://github.com/AdamBien/zllm-scripts
- Requires: Java 25+ on PATH
- Location: the composing skill's
scripts/directory — not installed into the OS
Why
OS commands have no limits: cat ~/.ssh/id_rsa, grep -r token /, or find / with megabytes of output. The zllm-scripts can't do any of that:
- read-only: no writes, no network, no spawned processes
- confined to a root: the nearest directory containing
.git, otherwise the current directory; paths and symlinks leaving it are refused - secrets refused:
.env,*.pem,*.key,.npmrc,id_rsa*and.git/are never read - bounded output: results are capped, long lines are cut, and stderr reports what was left out and how to continue
- one contract: the same exit codes and options in every script, so one permission rule per bundled script (
Bash(<composing skill's directory>/scripts/search:*)) replaces many per-command approvals
Setup
The scripts are bundled with the skill that uses them, never installed into the OS: no /usr/local/bin, no sudo, no PATH lookup. This skill ships no scripts. A composing skill carries copies of the scripts it uses in its own scripts/ directory, taken from https://github.com/AdamBien/zllm-scripts (filesystem/, javascript/, markdown/, clipboard/, skills/) and never edited in place; when upstream changes, the composing skill re-copies.
Call a script by its absolute path:
<composing skill's directory>/scripts/search <regex>
Every command name in this skill (files, search, show, ...) stands for that path. A script of the same name on the PATH is not used — the bundled copy is the version the composing skill was written against.
Check once per session that the scripts the composing skill uses are present and executable:
ls -l "<composing skill's directory>/scripts/"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 86 lines · 241 tokens per session scan C e2cfbcd0bd6e
zllm-scripts is a skill published in the GitHub repository AdamBien/airails (58 stars, last pushed 3d ago), licensed MIT. It adds 241 tokens to every session and 1,914 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.
Other skills, from other repositories
codex-docs-drift-scout
Install the AutoHub docs-drift Codex automation from signed AutoVault skill resources and audit its render fidelity with autovault doctor.
crisis-holding
Draft crisis holding statements, journalist Q&A posture, and what-not-to-say guidance from confirmed incident facts, with a hard legal-counsel gate. Builds each statement through proven crisis-comms frameworks (holding-statement anatomy, SCCT, CAP order, the legitimate non-answer, bridge/flag/block).
voice-extractor
Capture a user's real writing voice from 5-20 prior samples, store a local voice.yaml fingerprint, and enforce it on newsjack drafts so AI tells disappear. Measures voice with named stylometry lenses (Burrows's Delta function-word vector, MATTR lexical diversity, sentence-length burstiness, Biber Dimension-1 register…
fact-check
Extract factual claims from PR copy, verify each claim independently, attach concrete citations, and warn when certainty is low. Runs each claim through proven newsroom verification methods (lateral reading, source-tier climbing, provenance pillars, triangulation, calibrated rating) and puts the burden of proof on the…
find-journalists
Build a researched, fit-checked journalist list for a specific PR campaign. Prefer Medialyst's asynchronous media-list research workflow when available, with explicit approval before credit spend; otherwise produce a best-effort local list without guessed contacts.
story-origin-check
Recover the first public timestamp and canonical major coverage for a newsjacking signal, then decide whether newer coverage is the same story, a different story, or a materially new development.