Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aeonfun/aeon --skill github-monitorgit clone --depth 1 https://github.com/aeonfun/aeonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeonfun/aeon/github-monitor)<a href="https://agentmods.dev/skills/aeonfun/aeon/github-monitor"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/github-monitor.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 324 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 331 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.07782 |
| Opus 5 | $0.00024 | $0.03891 |
| Sonnet 5 | $0.00010 | $0.01556 |
| Haiku 4.5 | $0.00005 | $0.00778 |
Grade A, and why
github-monitor scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **`monitor`, `issues`, `prs` views** — use the `gh` CLI, which authenticates via the workflow's `GITHUB_TOKEN` / `GH_TOKEN` and works inside a GitHub Actions run (no curl fallback needed). `monitor` uses `gh pr/issue/r Copies of this mod
1 near-identical copy found in the catalogue:
- github-monitor — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 611 lines — stays where its author put it; the contents beside it link to each section on GitHub.
${var} — View selector + optional scope.
- empty → combined monitor over every repo in
memory/watched-repos.md.owner/repo(a bare repo, no view keyword) → combined monitor scoped to that one repo.issues [scope]→ new-issue triage queue.scopeacceptsowner/repo,org:foo,user:bar, or a bare login; empty = all repos owned by the authenticated user.releases [repo,repo,…]→ release upgrade-triage digest. Comma-separated repo list; empty = the built-in watch list.prs→ status tracker for PRs this aeon instance opened across external repos.add-repo:<owner/repo>→ appendowner/repotomemory/watched-repos.md, confirm, and end (the shape the Telegram force-reply sends — see the config-capture note in Shared setup). No view runs.
This skill is four focused views of the same GitHub surface. The combined monitor is the default; issues, releases, and prs each drill into one dimension with the sibling view's own filtering, ranking, and output format. Only the monitor and issues views take a repo scope; releases takes a repo list; prs takes no scope (it reads its config from aeon.yml/env).
Shared setup (every view)
- Read
memory/MEMORY.mdfor high-level context. - Read the last 2 days of
memory/logs/— used for dedup in themonitor,issues, andreleasesviews. - Parse
${var}into aVIEWand aSCOPE:
RAW="$(printf '%s' "${var}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
# Config capture (Telegram force-reply): var="add-repo:<owner/repo>" appends to the watchlist,
# confirms, and ends — it is NOT a view, so it must be intercepted before the VIEW parse below.
case "$RAW" in
add-repo:*)
CAND="$(printf '%s' "${RAW#add-repo:}" \
| sed -e 's#^https\?://github.com/##' -e 's/^@//' -e 's/\.git$//' \
-e 's/^[[:space:]]*//' -e 's/[[:space:]].*$//')"
if ! printf '%s' "$CAND" | grep -qE '^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$'; then
./notify "Couldn't read \"$CAND\" as a repo. Reply with owner/repo (e.g. acme/api)."
# log: - view: add-repo (var="${var}") → BAD_VALUE
exit 0
fi
mkdir -p memory; touch memory/watched-repos.md
if grep -qiE "^[[:space:]]*-[[:space:]]*${CAND}[[:space:]]*$" memory/watched-repos.md; then
./notify "Already watching $CAND."
else
printf -- '- %s\n' "$CAND" >> memory/watched-repos.md
./notify "Now watching $CAND — it'll show up in the next GitHub Monitor run."
fi
# log under ### github-monitor: - view: add-repo (var="${var}") → $CAND
exit 0 ;;
esac
if [ -z "$RAW" ]; then
VIEW=monitor; SCOPE=""
else
VIEW_TOKEN="$(printf '%s' "$RAW" | awk '{print tolower($1)}')"
SCOPE="$(printf '%s' "$RAW" | sed -E 's/^[^[:space:]]+[[:space:]]*//')" # everything after the first word
case "$VIEW_TOKEN" in
issues|releases|prs) VIEW="$VIEW_TOKEN" ;;
*) VIEW=monitor; SCOPE="$RAW" ;; # bare owner/repo scopes the combined monitor
esac
fi
- Dispatch to the matching view section below. Run exactly one view per invocation.
Selector examples: "" → monitor/all · anza-xyz/agave → monitor/one-repo · issues → issues/all · issues org:anthropics → issues/org · releases → releases/watch-list · releases anthropics/claude-code,openai/openai-python → releases/custom · prs → PR tracker.
Logging convention (all views): every view appends to memory/logs/${today}.md under the single heading ### github-monitor, and its first bullet is a discriminator naming the view that ran: - view: <monitor|issues|releases|prs> (var="${var}"). Keep the view-specific bullets exactly as described in each section — the identifiers/URLs they write are what the next run dedups against.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 611 lines · 48 tokens per session scan A 63a6b87c0268
github-monitor is a skill published in the GitHub repository aeonfun/aeon (716 stars, last pushed yesterday), licensed MIT. It adds 48 tokens to every session and 7,782 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
teamboard
Shared team board: claim a work item before starting, hand it over, finish it. The claim is a git-ref lock, so two people cannot take the same item.
standup-summary
Generate a standup or weekly-review update from actual work evidence - commits, branches, PRs, and issues across one or more repositories - grouped into done / in progress / blocked / next, written in plain human sentences rather than commit-message-speak. Use when preparing a daily standup, a weekly review, a sprint…
engineering-pr
Pull request lifecycle management. Use when you need to create a PR, handle PR reviews, resolve merge conflicts, or manage the PR-to-merge workflow. Extends the engineering skill with GitHub-specific tools and decision framework.
github-issues
Create, triage, label, assign GitHub issues via gh or REST.
agent-framework-py-release
Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…
parallel-feature-development
Coordinate parallel feature development with file ownership strategies, conflict avoidance rules, and integration patterns for multi-agent implementation. Use this skill when decomposing a large feature into independent work streams, when two or more agents need to implement different layers of the same system…