Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add altaidevorg/altai-app --skill run-in-altaigit clone --depth 1 https://github.com/altaidevorg/altai-appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/altaidevorg/altai-app/run-in-altai)<a href="https://agentmods.dev/skills/altaidevorg/altai-app/run-in-altai"><img src="https://agentmods.dev/badge/skills/altaidevorg/altai-app/run-in-altai/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/altaidevorg/altai-app/run-in-altai"><img src="https://agentmods.dev/badge/skills/altaidevorg/altai-app/run-in-altai.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.00868 |
| Opus 5.5 | $0.00030 | $0.00347 |
| Sonnet 5.5 | $0.00015 | $0.00174 |
| Haiku 4.5 | $0.00008 | $0.00087 |
Grade B, and why
run-in-altai scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
ALTAI ships first-class surfaces for both Colab and Jupyter. Use them. Never tell the user to "open colab.research.google.com in your browser" or "run `jupyter notebook` in a terminal" — the app already handles both insi How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ALTAI ships first-class surfaces for both Colab and Jupyter. Use them. Never tell the user to "open colab.research.google.com in your browser" or "run jupyter notebook in a terminal" — the app already handles both inside the workspace.
Colab
Trigger phrases: "open Colab", "run on Colab", "Colab GPU", "T4", "free GPU", an arXiv-paper reproduction request that needs a GPU, or any URL whose host is colab.research.google.com / colab.google.com / *.colab.google.com.
What to do:
- Open the Colab URL as a tab in ALTAI. The preview layer auto-promotes Colab hosts to a native child webview (
WebviewStack), so logins, runtimes, and cell execution work exactly as in a real browser. UsenewPreviewTab(url)and let the promotion happen, or callnewWebviewTab(url)directly for a fresh notebook (https://colab.research.google.com/#create=true). - For code execution against a Colab runtime that the agent needs to drive programmatically, route through the Colab MCP bridge that the IsanAgent runtime exposes (
python_run+ execution harness, provider = Colab). Do not shell out togcloud,colab-cli, or scraped HTTP endpoints. - If multiple Colab notebooks are open, each gets its own isolated webview label (
wv-<tab id>) — no shared session state, no login churn.
Do not:
- Iframe-embed Colab. The preview layer already refuses (X-Frame-Options); a webview tab is the only working path.
- Suggest the user copy code into Colab manually. The agent's
python_runtool runs it via the harness.
Jupyter
Trigger phrases: "open this notebook", "run the notebook", "edit cell …", "add a cell", any path ending in .ipynb, or a data-science / ML workflow that fits the Notebook Assistant built-in agent.
What to do:
- Open the
.ipynbwithopenNotebookTab(path). This routes toNotebookStack, which parses the notebook with the in-tree ipynb parser and renders editable cells — not a read-only preview. - Run cells through the execution harness (provider =
jupyterfor a local kernel,sshfor remote, orcolabfor free GPU). Do not spawn a standalonejupyter notebook/jupyter labserver and point the user atlocalhost:8888. - When adding cells, keep each cell focused on one logical step (load → transform → visualize → train → evaluate). Mirror the existing notebook's cell granularity.
- If the user asks for a new notebook, create the
.ipynbon disk first, then open it withopenNotebookTab. Do not paste cell content into the chat as a substitute.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 46 lines · 76 tokens per session scan B 7a16782e253a
run-in-altai is a skill published in the GitHub repository altaidevorg/altai-app (3 stars, last pushed yesterday), licensed Apache-2.0. It adds 76 tokens to every session and 868 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
anarlog
Query Anarlog meetings, notes, summaries, transcripts, participants, action items, and recurring history, or import a local recording. Use when a user asks about their Anarlog meeting data or needs meeting context for another task.
prompt-cache-optimizer
Audit and optimize Pisper system-prompt and tool-schema token overhead while preserving stable prompt-cache prefixes, permissions, and runtime behavior. Invoke only for explicit prompt or tool-context optimization work.
graphify-windows
Turn any folder of files into a navigable knowledge graph with community detection, an honest audit trail, and three outputs: interactive HTML, GraphRAG-ready JSON, and a plain-language GRAPHREPORT.md.
webgl-gate-audit
Procedures for auditing apps/landing TERMINAL VELOCITY WebGL phase gates - driving the browser to exact playhead positions across the 9 scenes, screenshot discipline, scrub + VAT determinism (scrub down THEN rewind to the same playhead -> identical frame), FPS sampling at the risk scenes, draw-call + bundle-size…
extension-standards
Browser-extension + bridge standards — MV3 (Chrome + Firefox), least-privilege permissions, the loopback pairing-token auth model, the shared TS↔Rust wire protocol, and the Chrome Web Store + Firefox AMO store-policy + pre-submission checklist. Load for changes under apps/extension/, extensionbridge/, and the…
tauri-pilot
Inspect, interact with, and test a running Tauri v2 app via CLI. Communicates over Unix socket using JSON-RPC 2.0. Use when testing UI, automating interactions, or debugging a Tauri app.