Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alunduil/alunduil-chezmoi --skill readmegit clone --depth 1 https://github.com/alunduil/alunduil-chezmoiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alunduil/alunduil-chezmoi/readme)<a href="https://agentmods.dev/skills/alunduil/alunduil-chezmoi/readme"><img src="https://agentmods.dev/badge/skills/alunduil/alunduil-chezmoi/readme/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alunduil/alunduil-chezmoi/readme"><img src="https://agentmods.dev/badge/skills/alunduil/alunduil-chezmoi/readme.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00607 |
| Opus 5 | $0.00026 | $0.00303 |
| Sonnet 5 | $0.00010 | $0.00121 |
| Haiku 4.5 | $0.00005 | $0.00061 |
Grade A, and why
readme scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
README
Reference: https://github.com/ddbeck/readme-checklist/blob/main/checklist.md
Checklist (condensed)
Identify — project name as first heading; repo/homepage URL near top; owner/author named.
Evaluate — describe why (what it achieves), not what (what it's made of). Active voice, second person. License named (open source) or authorized users named (closed source).
Use — prerequisites before install; install + basic usage, tested.
Engage — pointer to deeper docs (CONTRIBUTING, LICENSE, CHANGELOG, etc.) when they exist; where to get help (or explicit "no support"); how to contribute (or explicit "not accepting").
Final — TOC for 10+ screens; split into files past that.
Badges (shields.io)
Each badge earns its place: real-time, decision-relevant info not already visible on the rendered page (e.g. on github.com).
Usually qualifies:
- License —
img.shields.io/github/license/<owner>/<repo>— survives off-GitHub renders. - Code coverage when codecov/coveralls is wired up.
- Tool/config presence (pre-commit, Renovate, Dependabot) when used.
- Single-target platform/runtime when exactly one is supported.
Usually doesn't:
- CI status — GitHub shows it on commits; multi-workflow makes "build" ambiguous. Promote only when one named workflow is the gate.
- Last commit — already on the GitHub page.
- Release version — already on the sidebar; promote when README is rendered off-GitHub (npm, mirrors).
- Dependency counters — noisy/stale. "Renovate enabled" / "Dependabot enabled" is the usable substitute.
Test: would removing this badge lose information the reader couldn't get from the page above?
Procedure
- Read the README. Name the actual audience.
- Ethos first — for each existing section, name the reader need it serves (identify / evaluate / use / engage). Sections serving no need are noise; flag them to cut, even if the checklist nominally has a slot. "What it's made of" tours, internal implementation notes, and speculative future plans usually fall here.
- Gaps — walk the checklist to find reader needs not yet covered. The checklist is a prompt for missing needs, not a license for existing sections.
- Walk the badges against the principle; flag any that don't earn their place.
- Surface findings before editing. Apply only after scope is agreed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 56 lines · 51 tokens per session scan A 70cb25319d91
readme is a skill published in the GitHub repository alunduil/alunduil-chezmoi (2 stars, last pushed yesterday), licensed 0BSD. It adds 51 tokens to every session and 607 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
batch-grill-me
A relentless interview that asks every frontier question at once, round by round.
dotfiles-bootstrap
Bootstrap a workstation with the dotfiles framework. Takes a GitHub user / owner+repo / explicit clone URL and runs dot init (which shells out to chezmoi) with the right safety prompts. Honors the active agent profile (ask / plan / apply / audit) so it defaults to dry-run in safer modes and full apply in apply.
vibe
Delegate a coding task to a cheap AI model (Mistral Vibe by default, but any provider Vibe knows about — DeepSeek, Gemini Flash, etc.) and supervise the result via git diff. Claude orchestrates, the cheap model codes. Claude consumes 500-1500 tokens per delegation regardless of how many file reads the delegate does…
aiq-research
Use when asked to run deep research or AI-Q research through a reachable NVIDIA AI-Q Blueprint backend.
telegram
Send notifications, interactive questions, or multiple-choice polls to the user via Telegram. Use when the user asks to be notified ("ping me", "notify me on Telegram", "ask me when..."), when a long-running task finishes and the user is likely away, when an irreversible action needs out-of-band confirmation, or when…
repo-activity
Scan all git repositories under /repos and report recent activity — last commit age, branch, uncommitted changes — in age-bucketed tables. Use when the user asks for a repo activity overview, "what have I been working on", portfolio status, or which repos are active/dormant.