OpenTag connects Slack with coding agents running on a computer controlled by the user, so channel mentions can queue work and return status, decisions, and evidence in the same thread. It is for engineering teams that want to run agents such as Claude Code, Codex, or Cursor against local checkouts through the Agent Client Protocol.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add amplifthq/opentag --skill opentaggit clone --depth 1 https://github.com/amplifthq/opentagWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/amplifthq/opentag/opentag)<a href="https://agentmods.dev/skills/amplifthq/opentag/opentag"><img src="https://agentmods.dev/badge/skills/amplifthq/opentag/opentag/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/amplifthq/opentag/opentag"><img src="https://agentmods.dev/badge/skills/amplifthq/opentag/opentag.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01101 |
| Opus 5 | $0.00032 | $0.00550 |
| Sonnet 5 | $0.00013 | $0.00220 |
| Haiku 4.5 | $0.00006 | $0.00110 |
Grade A, and why
opentag scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenTag
Supported route
Slack Source App
-> self-hosted Control Plane
-> paired local Runner
-> ACP Agent in one local checkout
-> GitHub Project Target/publication
-> truthful result in the originating Slack thread
Slack is the only Source App. GitHub is the Project Target and publication/evidence provider. The Control Plane owns Slack ingress, custody, and projection; the Runner owns local execution.
Load the needed reference
- Compose deployment, Slack bootstrap, TLS, or pairing authority:
references/control-plane.md - Slack app URLs, events, scopes, channel binding, or missing mentions:
references/slack-setup.md - GitHub target, local checkout, publication, or readback:
references/github-setup.md - Codex or another supported ACP executor:
references/codex-runner.md - Any failed readiness, pairing, Run, or delivery step:
references/troubleshooting.md
Load only the references whose branch applies.
Guardrails
- Pair only with the exact HTTPS Control Plane origin the user operates or explicitly trusts.
- Keep Slack signing and bot secrets in Control Plane secret files. Its
.envcontains only their host-side file paths and non-secret Slack identifiers. - Enter the bootstrap pairing authority and GitHub token through local secret input. Keep them out of chat, command arguments, logs, screenshots, and git.
- The ACP Agent edits only the assigned local checkout. OpenTag performs Slack delivery and GitHub publication through governed provider boundaries.
- Preserve unrelated working-tree changes. Confirm the checkout and target before enabling write-capable work.
- Run completion, enqueue, approval, and provider acceptance are separate
facts. Preserve
outcome_unknownuntil the original provider operation is reconciled.
Paired workflow
- Bootstrap the Control Plane and Slack installation from
deploy/compose/.env.example, using file-backed Slack secrets, then start Compose behind TLS. Completion: the Compose project reports healthy,/readyzsucceeds, and bootstrap logs show the intended Slack binding without secret plaintext.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · -39 lines · +24 tokens per session 12e29178c812
- 10d ago First seen · 176 lines · 40 tokens per session scan A 4f274de354bc
opentag is a skill published in the GitHub repository amplifthq/opentag (1,380 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 1,101 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
configure-coddy
Change Coddy's own configuration when the user asks for it: edit settings, providers, models, logging, permissions, or find, install, update, and remove MCP servers and skills. Stages UCI-style commands and commits only after the user confirms saving. Load when the user explicitly asks to change a Coddy setting, or…
generate-rules
Scan the codebase and generate or refresh focused project rules under .coddy/rules/.
vulnerability-writeup
Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.
track-findings
Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use…
deep-security-scan
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the…
assess-patch-risk
Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate…