Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alunduil/alunduil-chezmoi --skill codecovgit clone --depth 1 https://github.com/alunduil/alunduil-chezmoiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alunduil/alunduil-chezmoi/codecov)<a href="https://agentmods.dev/skills/alunduil/alunduil-chezmoi/codecov"><img src="https://agentmods.dev/badge/skills/alunduil/alunduil-chezmoi/codecov/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alunduil/alunduil-chezmoi/codecov"><img src="https://agentmods.dev/badge/skills/alunduil/alunduil-chezmoi/codecov.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00816 |
| Opus 5.5 | $0.00025 | $0.00326 |
| Sonnet 5.5 | $0.00013 | $0.00163 |
| Haiku 4.5 | $0.00006 | $0.00082 |
Grade A, and why
codecov scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`https://api.codecov.io` base. Don't shell out to `curl` directly. How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codecov
Auth is already in env — dot_bashrc exports CODECOV_API_TOKEN. The
codecov-api wrapper in ~/.local/bin/ injects auth + the
https://api.codecov.io base. Don't shell out to curl directly.
Triggers
- "Is
<test>flaky?" / "What's its failure rate?" - "Show failed tests on
<branch>recently." - "Why is
<test>failing?" (stack trace lookup) - "What's the coverage delta on this PR / file / branch?"
- Any Codecov UI URL behind the login wall.
Repo coordinates
Most paths take {service}/{owner}/{repo} where service is one of
github, gitlab, bitbucket (no .com). Derive from the current
checkout via git remote get-url origin.
REST — flaky / failed tests
GET /api/v2/{service}/{owner}/repos/{repo}/test-results/
Verified query parameters:
branch— filter by branch namecommit_id— filter by commit SHAoutcome—pass|failure|skip|errorduration_min/duration_max— secondspage/page_size— pagination
codecov-api "/api/v2/github/<owner>/repos/<repo>/test-results/?branch=main&outcome=failure&page_size=100"
Detail (stack trace, etc.):
codecov-api "/api/v2/github/<owner>/repos/<repo>/test-results/<id>/"
REST has no flake_rate filter and no test-name filter. For a
ranked flake answer, paginate outcome=failure, group by name,
divide by total runs of that name (separate call without outcome),
or use GraphQL.
GraphQL — ranked flake aggregates
POST /graphql/ is the same wrapper:
codecov-api /graphql/ \
-X POST -H 'Content-Type: application/json' \
-d '{"query":"...","variables":{...}}'
Schema entry points worth knowing: repository.testAnalytics.testResults,
repository.testAnalytics.flakeAggregates. When in doubt, fetch the
schema ({ __schema { types { name } } }) and read it.
Coverage queries
The full v2 swagger lives at https://api.codecov.io/api/v2/docs/
— consult it for commits/, report/, pulls/{id}/, compare/
endpoints rather than memorising paths. All take the same {service}/ {owner}/{repo} prefix and the same auth.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 88 lines · 63 tokens per session scan A b7248833795b
codecov is a skill published in the GitHub repository alunduil/alunduil-chezmoi (2 stars, last pushed today), licensed 0BSD. It adds 63 tokens to every session and 816 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
airflow
Develop and test Airflow DAGs with the Astronomer astro CLI.
cli-development
Design and build Python CLIs with Typer: commands, output contracts, and tests.
smoke
Smoke-test every repo task and CLI command; warnings count as failures.
factory-testing
Testing conventions across builds. Vitest + Playwright as the locked stack; tests co-located in tests next to the code they verify; shared test primitives (provider wrappers, mock factories) centralized in src/lib/test-utils.tsx; coverage thresholds enforced at the merge gate (CI ownership lives in factory-ci.md).…
test-code
Testing philosophy, test types (unit, integration, golden, fuzz, property, benchmark, smoke, E2E), per-language conventions (Rust, Go, Python, TypeScript), file organization, fixtures/mocks, CI strategy, and what NOT to test. Use when writing tests, reviewing test coverage, setting up test infrastructure, or deciding…
speeding-up-laravel-tests
Use when Laravel/Pest test suites are slow, CI duration is growing, individual tests take seconds, or the user asks to speed up, optimize, or profile tests. Covers factories, fakes, config caching, XDebug/pcov, BCRYPTROUNDS, LazilyRefreshDatabase, and stray HTTP requests.