Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alinaqi/maggy --skill session-managementgit clone --depth 1 https://github.com/alinaqi/maggyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alinaqi/maggy/session-management)<a href="https://agentmods.dev/skills/alinaqi/maggy/session-management"><img src="https://agentmods.dev/badge/skills/alinaqi/maggy/session-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alinaqi/maggy/session-management"><img src="https://agentmods.dev/badge/skills/alinaqi/maggy/session-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 128 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00013 | $0.03335 |
| Opus 5 | $0.00006 | $0.01667 |
| Sonnet 5 | $0.00003 | $0.00667 |
| Haiku 4.5 | $0.00001 | $0.00333 |
Grade A, and why
session-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 529 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Session Management Skill
For maintaining context across long development sessions and enabling seamless resume after breaks.
Core Principle
Checkpoint at natural breakpoints, resume instantly.
Long development sessions risk context loss. Proactively document state, decisions, and progress so any session can resume exactly where it left off - whether returning after a break or hitting context limits.
Tiered Summarization Rules
Tier 1: Quick Update (current-state.md only)
Trigger: After completing any small task or todo item Action: Update "Active Task", "Progress", and "Next Steps" sections Time: ~30 seconds
Tier 2: Full Checkpoint (current-state.md + decisions.md)
Trigger:
- After completing a feature or significant change
- After any architectural/library decision
- After ~20 tool calls during active work
- When switching to a different area of the codebase
Action:
- Update full current-state.md
- Log any decisions to decisions.md
- Update files being modified table
Tier 3: Session Archive (archive/ + full checkpoint)
Trigger:
- End of work session
- Completing a major feature/milestone
- Before a significant context shift
- When context feels heavy (~50+ tool calls)
Action:
- Create archive entry:
archive/YYYY-MM-DD[-topic].md - Full checkpoint
- Clear verbose notes from current-state.md
- Update code-landmarks.md if new patterns introduced
Decision Heuristic
┌─────────────────────────────────────────────────────┐
│ After completing work, ask: │
├─────────────────────────────────────────────────────┤
│ Was a decision made? → Log to decisions.md │
│ Task took >10 tool calls? → Full Checkpoint │
│ Major feature complete? → Archive │
│ Ending session? → Archive + Handoff │
│ Otherwise → Quick Update │
└─────────────────────────────────────────────────────┘
Session State Structure
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 529 lines · 13 tokens per session scan A 2fc04c41efeb
session-management is a skill published in the GitHub repository alinaqi/maggy (705 stars, last pushed yesterday), licensed MIT. It adds 13 tokens to every session and 3,335 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
composio
Route and complete Composio work across Composio For You and Composio Platform. Use when the user mentions Composio; wants an agent to use apps such as Gmail, Slack, GitHub, Notion, Calendar, or Linear; needs first-time setup, an SDK or MCP integration, CLI operation, migration guidance, current documentation, or help…
python-release
Handle Python SDK release, build, bump, packaging metadata, PyPI client pin, uv.lock, nox/build workflow, and publish verification changes. Use for Python release process work or dependency pin bumps; do not use for ordinary Python feature implementation.
report
Writes the session final report to a file, then prints only the path and a one-line summary. Fires when the prompt contains "Report per memstack:report", and also when the prompt begins with a standing trigger configured through MEMSTACKREPORTONTASKPROMPTS or MEMSTACKREPORTTRIGGERS. Dormant otherwise.
memstack-automation-n8n-workflow-builder
Use this skill when the user says 'n8n workflow', 'build a workflow', 'automation workflow', 'connect services', or needs visual workflow design with node mapping, data transformations, and error handling for n8n. Do NOT use for standalone webhook endpoints or cron jobs.
token-optimization
Use when the user says 'token optimization', 'save tokens', 'context window', 'reduce tokens', 'token stack', or 'TokenStack', or asks about extending context window capacity. Covers TokenStack, the built-in compression proxy that shrinks Claude Code tool output before it reaches the Anthropic API. Do NOT use for…
state
Use when the user says 'update state', 'project state', 'where was I', or at session start to load current context.