A helper for starting temporary virtual machines with KVM and QEMU, software that runs another operating system inside a window or isolated environment. It is designed for testing the setup tool without changing the main computer.

Use it to create and boot test machines for CachyOS or Ubuntu-related setup work, inspect installation behavior, and try changes in an isolated environment.

It provides a separate test environment for operating-system setup flows, reducing the risk of altering the host system. It also records the required virtualization dependencies and setup limits.

How AmineDjeghri/personal-os-setup configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to AmineDjeghri/personal-os-setup. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/AmineDjeghri/personal-os-setup/main/.claude/skills/vm-lab/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/AmineDjeghri/personal-os-setup

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/aminedjeghri/personal-os-setup/vm-lab/github.svg)](https://agentmods.dev/skills/aminedjeghri/personal-os-setup/vm-lab)

Your own site

<a href="https://agentmods.dev/skills/aminedjeghri/personal-os-setup/vm-lab"><img src="https://agentmods.dev/badge/skills/aminedjeghri/personal-os-setup/vm-lab/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/aminedjeghri/personal-os-setup/vm-lab"><img src="https://agentmods.dev/badge/skills/aminedjeghri/personal-os-setup/vm-lab.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 84 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 924 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Privilege Escalation · line 18
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
medium Rogue Agent · line 18
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00084	$0.00924
Opus 5.5	$0.00034	$0.00370
Sonnet 5.5	$0.00017	$0.00185
Haiku 4.5	$0.00008	$0.00092

Measured 6d ago against content hash 144101509dab, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

vm-lab scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

`make vm-deps` then does `sudo systemctl enable --now libvirtd.service`, adds your user to the `libvirt`/`kvm` groups, and starts the default virsh network — **requires sudo**, and **you must log out and back in** before

.claude/skills/vm-lab/SKILL.md · 37 lines

How it starts

The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Local VM lab (`scripts/vm.sh` + `makefiles/vm.mk`)

A libvirt/QEMU helper for booting throwaway VMs to test OS-setup flows without touching the host. CachyOS-host only (its dependency check shells out to pacman -Qi).

⚠️ Every command in this skill mutates the host or a VM's disk state (installs packages, needs sudo, creates/destroys VMs, downloads multi-GB ISOs). Confirm the specific command with the user before running any of them — including make vm-deps, any vm-* target, and scripts/vm.sh invocations — even if the user already asked for the VM lab in general terms. Canon: AGENTS.md § "Safety: confirm before system-mutating actions (MANDATORY)".

One-time setup

make vm-deps checks for qemu-full libvirt virt-manager dnsmasq edk2-ovmf cloud-image-utils via pacman -Qi. Anything missing, it tells you to install it through the app's own Packages tab (Dev_tools category) rather than installing it itself — package installs stay funneled through the TUI's package-manager code path.

⚠️ That package list is a manual mirror of packages.yaml's cachyos.pacman.Dev_tools VM entries — nothing checks that they stay in sync. Update both when you add/remove a VM dependency.

make vm-deps then does sudo systemctl enable --now libvirtd.service, adds your user to the libvirt/kvm groups, and starts the default virsh network — requires sudo, and you must log out and back in before VM commands work.

Commands

scripts/vm.sh {cachyos|ubuntu-server-auto|ubuntu-server-manual|ubuntu-desktop|list|clean}, wrapped by make vm-cachyos / make vm-ubuntu-server / make vm-ubuntu-server-manual / make vm-ubuntu / make vm-list / make vm-clean.

State (ISOs, disks, cloud-init seeds) lives under .vm/ at repo root (gitignored).

Gotchas

make vm-clean is destructive: it virsh destroy+undefines every pos-* VM and deletes the disk/cloud-init dirs (cached ISOs are kept). Confirm before running it if VMs might hold in-progress work.
Re-running a VM target on an existing VM name just resumes it — it does not pick up new settings. Change AUTOINSTALL_USER/AUTOINSTALL_PASSWORD for vm-ubuntu-server and re-run, and nothing changes until you make vm-clean first.
AUTOINSTALL_USER/AUTOINSTALL_PASSWORD default to pos-dev (the password falls back to the resolved user name when unset) — a throwaway credential, scoped to an ephemeral local dev VM. Override via env vars for anything longer-lived.
The CachyOS ISO URL is scraped from SourceForge's RSS feed and is not cryptographically verified — only presence/size is trusted. If the markup changes, fetch_cachyos_iso_url() breaks and tells you to download manually rather than silently using a bad URL.
Ubuntu image URLs are hardcoded to a specific release (currently 26.04) inside scripts/vm.sh — bump manually when a new release ships, it isn't derived dynamically.
The Ubuntu auto-install flow attaches the cloud-init seed ISO as the second CD-ROM device (/dev/sr1) — order-of-operations dependent on virt-install's --disk/--location args; don't reorder them without re-testing a full auto-install run.

Read the full file on GitHub · 37 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago Changed · -2 lines 144101509dab
28d ago Changed · +3 lines 26d5034ef125
1mo ago Changed 05b09314dc27
1mo ago First seen · 36 lines · 84 tokens per session scan B 202554580710

Subscribe to this mod's changes

vm-lab is a skill published in the GitHub repository AmineDjeghri/personal-os-setup (662 stars, last pushed today), licensed MIT. It adds 84 tokens to every session and 924 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Testing apps windows windows-11 windows11 wsl wsl2

hula-skill

HuLa project skill for frontend (Vue 3 + Vite + UnoCSS + Naive UI/Vant), backend (Tauri v2 + Rust + SeaORM/SQLite), full-stack flows, and build/release work. Use when the user mentions hula or HuLa or requests changes in this repository; after triggering, ask which scope (frontend/backend/fullstack/build-release) to…

HuLaSpark/HuLa · 86 tokens

test-ui

Test the BrowserOS app extension UI by starting the dev environment and visually verifying changes via CDP. Covers the new tab page (left sidebar — Home, Scheduled Tasks, Settings, etc.) and the right side panel (chat interface). Use after making UI changes to apps/app/.

browseros-ai/BrowserOS · 59 tokens

personal-os-setup: Skill for Claude Code

Borrowing it

Wrote this? Show the measurements

What it costs to keep this loaded

Grade B, and why

Asks for rootmediumPrivilege escalation

How it starts

Local VM lab (`scripts/vm.sh` + `makefiles/vm.mk`)

One-time setup

Commands

Gotchas

What this file has done since we first saw it

Other skills, from other repositories

hula-skill

test-ui

aegis-tdd

testing

test-driven-development

flow-launcher

personal-os-setup: Skill for Claude Code

Borrowing it

Wrote this? Show the measurements

What it costs to keep this loaded

Grade B, and why

Asks for rootmediumPrivilege escalation

How it starts

Local VM lab (scripts/vm.sh + makefiles/vm.mk)

One-time setup

Commands

Gotchas

What this file has done since we first saw it

Other skills, from other repositories

hula-skill

test-ui

aegis-tdd

testing

test-driven-development

flow-launcher

Local VM lab (`scripts/vm.sh` + `makefiles/vm.mk`)