Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aliengiraffe/vigilante --skill vigilante-issue-implementation-on-phpgit clone --depth 1 https://github.com/aliengiraffe/vigilanteWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-php)<a href="https://agentmods.dev/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-php"><img src="https://agentmods.dev/badge/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-php/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-php"><img src="https://agentmods.dev/badge/skills/aliengiraffe/vigilante/vigilante-issue-implementation-on-php.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.00991 |
| Opus 5 | $0.00019 | $0.00495 |
| Sonnet 5 | $0.00008 | $0.00198 |
| Haiku 4.5 | $0.00004 | $0.00099 |
Grade A, and why
vigilante-issue-implementation-on-php scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vigilante PHP Issue Implementation
Focus
- Read the prompt for detected tech stacks, process hints, and PHP security guidance before changing code.
- Follow repo-standard Composer, testing, formatting, and static-analysis workflows.
- Prefer repo-defined framework and tooling conventions over forcing a universal PHP stack.
- Keep changes scoped to the issue and do not broaden into unrelated style or lint fixes.
PHP Tooling Workflow
- Composer: use Composer-managed commands and dependency workflows. Run
composer installfor reproducible installs fromcomposer.lock. Runcomposer updateonly when intentionally upgrading dependencies. - Testing: run targeted tests for changed code first using
vendor/bin/phpunit --filter ClassNameor the framework-native test command (e.g.,php artisan test,vendor/bin/pest). Use broadervendor/bin/phpunitwhen changes cross module boundaries. Respect the repository's test configuration (phpunit.xml,phpunit.xml.dist). - Static analysis: use the repository's established static-analysis tools. When PHPStan is configured (
phpstan.neon,phpstan.neon.dist), runvendor/bin/phpstan analyse. When Psalm is configured (psalm.xml,psalm.xml.dist), runvendor/bin/psalm. Do not introduce a different analyzer unless the issue specifically requires it. - Formatting: use the repository's established code-style tool. When PHP CS Fixer is configured (
.php-cs-fixer.php,.php-cs-fixer.dist.php), runvendor/bin/php-cs-fixer fix. When PHP_CodeSniffer is configured (phpcs.xml,phpcs.xml.dist,.phpcs.xml), runvendor/bin/phpcsto check andvendor/bin/phpcbfto fix. Do not hand-format PHP code when an automated tool is available. - Dependencies: run
composer auditafter dependency changes to check for known vulnerabilities. Reviewcomposer.lockchanges for unexpected additions or version shifts.
Security
- Use
password_hash()withPASSWORD_DEFAULTorPASSWORD_BCRYPTfor password storage, andpassword_verify()to check passwords. Never usemd5(),sha1(), orcrypt()directly for passwords. - Use parameterized queries or the framework's query builder to prevent SQL injection — never interpolate user input into raw SQL.
- Use context-appropriate output encoding (
htmlspecialchars()withENT_QUOTES, framework template escaping) to prevent XSS. - Avoid
unserialize()on untrusted data — usejson_decode()andjson_encode()for data interchange. Whenunserialize()is unavoidable, restrict allowed classes with theallowed_classesoption. - Do not store secrets, tokens, or credentials in source files. Use environment variables or framework-native secret management.
- Use framework-provided CSRF protection for state-changing requests.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 42 lines · 39 tokens per session scan A 256e292067f7
vigilante-issue-implementation-on-php is a skill published in the GitHub repository aliengiraffe/vigilante (40 stars, last pushed today), licensed Apache-2.0. It adds 39 tokens to every session and 991 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-oauth-nango-integration
Use when implementing GitHub OAuth + GitHub App authentication with Nango - provides two-connection pattern for user login and repo access with webhook handling.
api-documenter
Auto-generate API documentation from code and comments. Use when API endpoints change, or user mentions API docs. Creates OpenAPI/Swagger specs from code. Triggers on API file changes, documentation requests, endpoint additions.
skill-packager
Authors Agent Skills v1.0 packages (SKILL.md plus references/scripts), runs packageskill to produce a standards-compliant zip, and uses installskill to add skills from HTTPS, registry, workspace, or an uploaded archive. Use when the user wants to turn documentation, workflows, or code into a portable skill, export a…
document-processor
Guidance for processing documents, extracting content, and transforming structured information. Use when the user asks to process, parse, extract, or transform document content such as PDFs, Word files, or spreadsheets.
workflow-helper
Guidance for creating, managing and executing workflow automations that chain multiple tools and agents together. Use when the user asks about building, listing, running or composing workflows and automated task pipelines.
attendance-signin-sheet
A spreadsheet generator for printable attendance or meeting sign-in sheets. It turns a list of names into rows with columns such as signatures, dates, departments, or employee IDs.