Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alp82/aistack --skill aistack-syncgit clone --depth 1 https://github.com/alp82/aistackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alp82/aistack/aistack-sync)<a href="https://agentmods.dev/skills/alp82/aistack/aistack-sync"><img src="https://agentmods.dev/badge/skills/alp82/aistack/aistack-sync/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alp82/aistack/aistack-sync"><img src="https://agentmods.dev/badge/skills/alp82/aistack/aistack-sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 38 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 48 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 45 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00505 |
| Opus 5.5 | $0.00022 | $0.00202 |
| Sonnet 5.5 | $0.00011 | $0.00101 |
| Haiku 4.5 | $0.00006 | $0.00051 |
Grade A, and why
aistack-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
aistack sync
Publish the local measured-usage snapshot to the user's aistack stack. The
aistack MCP server does all the work: it scans the transcripts on this
machine, stages the exact bytes, and gates the send behind a dialog only the
user can answer. You trigger and display. You never decide.
Steps
- Call the
sync_previewtool on theaistackMCP server. No arguments. - Show the returned text to the user verbatim, in a code block. Do not summarize it. Do not omit lines. Do not add numbers of your own.
- If the output says
publish unavailable, stop and relay the reason. - If the user asked for a sync, call
sync_publishwith thepreview idfrom the output. A confirmation dialog appears. The user answers it themselves. Wait; the dialog can take minutes. - Relay the tool result verbatim. "Not published" is a valid outcome, not an error to work around.
Rules
- Never call
sync_publishwithout async_previewin the same conversation. - Never replace the preview text with your own summary. The preview is the review surface the user consents on.
- A cancel or a timeout is the user's answer. Do not raise the gate again in the same turn. Retry only when the user asks.
- If the
aistackMCP server is not connected, say so and point at the setup step below. Do not publish through any other channel. There is none.
Setup (one time, done by the user)
npx @use-aistack/cli connect claude
That installs both halves: the aistack MCP server (user scope) and this
Skill. Manual alternative:
claude mcp add --scope user aistack -- npx -y @use-aistack/cli mcp
The machine must be linked once with npx @use-aistack/cli login.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 49 lines · 56 tokens per session scan A 0230b7b2dc6a
aistack-sync is a skill published in the GitHub repository alp82/aistack (50 stars, last pushed 18d ago), licensed MIT. It adds 56 tokens to every session and 505 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
service-learning-project-designer
Design a service-learning project connecting genuine community need with embedded curriculum learning. Use when planning community projects, civic engagement, or social action units.
ubuntu-collective-knowledge-task-designer
Design learning tasks built on Ubuntu philosophy emphasising collective knowledge-building and mutual responsibility. Use when fostering collaboration that values community over individual competition.
place-based-curriculum-orchestrator
Present pathway options and orchestrate place-based curriculum design from a local place, curriculum requirement, or community issue. Use when place should become a primary text for learning.
create-roadmap
Generates a battle-tested, phased master roadmap (progress.md) from any app idea or feature spec. Breaks development into foundational infrastructure, modular features, settings, monetization, security, polish, and store publishing, modeled after production systems like Floatkit.
project-scaffold
Scaffolds a complete project memory and multi-agent coordination system (gemini.md, AGENTSYNC.md, progress.md, taskplan.md, findings.md, crash-log.txt, .env.example, .gitignore). Provides a streamlined, stack-agnostic alternative to the B.L.A.S.T. protocol for deterministic development and seamless agent handoffs.
team-summary
Creates and maintains TEAMSUMMARY.md (or TEAMLOG.md) to track individualized work summaries for each team member or AI agent persona. Gives every contributor their own persistent section with recent accomplishments, modified files, active focus, and blockers without overwriting other members' logs.