Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aliengiraffe/vigilante --skill vigilante-issue-implementation-on-kubernetesgit clone --depth 1 https://github.com/aliengiraffe/vigilanteWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-kubernetes)<a href="https://agentmods.dev/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-kubernetes"><img src="https://agentmods.dev/badge/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-kubernetes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-kubernetes"><img src="https://agentmods.dev/badge/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-kubernetes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.00918 |
| Opus 5.5 | $0.00016 | $0.00367 |
| Sonnet 5.5 | $0.00008 | $0.00184 |
| Haiku 4.5 | $0.00004 | $0.00092 |
Grade A, and why
vigilante-issue-implementation-on-kubernetes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vigilante Kubernetes Issue Implementation
Focus
- Read the prompt for detected tech stacks, process hints, and Kubernetes security guidance before changing manifests.
- Treat Kubernetes manifest changes as operationally sensitive — not as generic YAML edits.
- Keep changes scoped to the issue and do not broaden into unrelated cluster-ops or security redesign work.
Manifest Hygiene
- Use recommended Kubernetes labels (
app.kubernetes.io/name,app.kubernetes.io/version, etc.) on all new resources. - Validate manifest YAML syntax before committing. Use
kubectl --dry-run=client -o yamlor an equivalent offline validator when available. - Prefer
kustomizeoverlays or Helm values for environment-specific configuration rather than duplicating manifests. - Keep resource definitions focused — one resource per file when practical, with clear naming.
Service Account Hygiene
- Do not use the
defaultservice account for workloads. Create dedicated service accounts scoped to the workload's needs. - Set
automountServiceAccountToken: falseon pods and service accounts that do not need API access. - When a workload requires API access, bind the minimum RBAC permissions to its dedicated service account.
Pod and Container Security Context
- Set
runAsNonRoot: trueand specify a numericrunAsUserin the pod or containersecurityContext. - Set
allowPrivilegeEscalation: falseon containers. - Set
readOnlyRootFilesystem: truewhere the application supports it, usingemptyDirvolumes for writable paths. - Drop all capabilities and add back only what is required:
securityContext.capabilities.drop: ["ALL"]. - Prefer
RestrictedPod Security Standards when the workload allows it.
RBAC and Permissions
- Follow least-privilege principles: prefer
RoleandRoleBinding(namespace-scoped) overClusterRoleandClusterRoleBindingunless the workload genuinely needs cluster-wide access. - Avoid wildcards (
*) in RBAC rules for verbs, resources, or API groups. - When the issue only requires application-level changes, do not introduce or modify cluster-scoped resources.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 62 lines · 39 tokens per session scan A c600ce52abf5
vigilante-issue-implementation-on-kubernetes is a skill published in the GitHub repository aliengiraffe/vigilante (41 stars, last pushed yesterday), licensed Apache-2.0. It adds 39 tokens to every session and 918 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bmad-correct-course
Assess the impact of a significant change during sprint execution across the PRD, epics, architecture, and UX documents, and produce a sprint change proposal. Use when the user says "correct course" or "propose sprint change".
bmad-spec
Condense any input — an idea, brief, PRD, transcript, or mixed notes — into a short spec: one kernel file plus supporting files that downstream skills build from. Also updates and validates existing specs. Use when the user says "create a spec", "distill this into a spec", "validate this spec", or "update the spec".
bmad-product-brief
Create, update, or validate a product brief. Use when the user wants help producing, editing, or validating a brief.
bmad-deep-recon
Research a topic to support a decision, three ways: draft a research prompt for the user to run in their own tool (ChatGPT, Gemini, Grok, Perplexity, …), turn a finished research report into a short summary with cited sources that other skills can use directly, or run the research here with parallel web searches.…
bmad-ticket
Create and manage tickets — initiatives, epics, stories, bugs. Use when the user says "create a new initiative", "slice this initiative", "split this epic up", "break this into stories", "incept this epic", "make a ticket", "refine this ticket", "what's ready", "status of a story", "publish ticket changes", "validate…
bmad-eval
Runs the evals of a BMad skill through the agent harness the user works in and reports what they show: baseline against the bare model, variant against a stripped or prior version, quality against a rubric, and trigger accuracy of the description with an optional optimization loop. Use when the user asks to evaluate…