Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add anotb/x-signal --skill x-setupgit clone --depth 1 https://github.com/anotb/x-signalWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anotb/x-signal/x-setup)<a href="https://agentmods.dev/skills/anotb/x-signal/x-setup"><img src="https://agentmods.dev/badge/skills/anotb/x-signal/x-setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00462 |
| Opus 5 | $0.00021 | $0.00231 |
| Sonnet 5 | $0.00008 | $0.00092 |
| Haiku 4.5 | $0.00004 | $0.00046 |
Grade A, and why
x-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
X Signal setup
- Call
x_statuswithliveProbe: true, then distinguish app, database, browser/CDP, X authentication/challenge, captured operation, and tunnel failures. - Check
docker compose ps,/healthz,/readyz, and redacted service logs. Usehttp://127.0.0.1:6080/vnc.htmlonly for visible sign-in or challenge recovery. - The persistent browser profile survives Compose and host restarts. For an alternate account, recommend a dedicated Chrome profile with the companion installed, automatic sync left on, and Use this profile selected once; the everyday Chrome profile can remain on another account. Never ask the user to paste cookies or tokens into chat. Check all named sources'
lastSeenAtplus the active source'slastSyncedAt/lastAppliedAtand anypendingSessionSource. A different prepared profile is selected intentionally and automatic sync completes the switch after current runs settle. An account change inside the selected profile is detected from cookie changes and automatically deferred/retried behind active research. A same-profile one-time transfer can pause automatic sync, but X may invalidate it when that profile changes accounts. - For local MCP clients use
http://127.0.0.1:7345/mcp. For ChatGPT, use the Composechatgptprofile and the hiddennpm run tunnel:secure:configureprompt. Configure the tunnel ID, its owning Platform organization ID, and the runtime key so accounts with multiple organizations have an explicit control-plane context. Check the local tunnel/readyzand verify workspace association plus Tunnels Read + Use if it is not listed. Never capture or repeat a tunnel ID, organization ID, or runtime key. Use the path-gated temporary command only for an explicitly short-lived fallback, then refresh the app after schema changes. - Give exact recovery commands and recheck status. Do not bypass X challenges or weaken loopback/tunnel authentication.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 13 lines · 42 tokens per session scan A fd0404a12ef4
x-setup is a skill published in the GitHub repository anotb/x-signal (1 stars, last pushed 24d ago), licensed MIT. It adds 42 tokens to every session and 462 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hermes-s6-container-supervision
Modify or debug s6 services in the Hermes Docker image.
docker-debug
Debug Kurtosis running on local Docker. Inspect engine, API container, and service logs. Diagnose container crashes, port conflicts, and networking issues. Use when kurtosis commands fail or services aren't reachable on Docker.
k8s-debug-pods
Debug Kurtosis pods on Kubernetes. Diagnose why pods are Pending, CrashLoopBackOff, ImagePullBackOff, or Evicted. Check node taints, tolerations, resource pressure, and pod events. Use when kurtosis engine start fails or pods aren't coming online.
debug-issue
Systematic Godot debugging decision trees for physics, signals, rendering, navigation, and input issues.
setup-bot
Diagnose and fix Telegram bot connection issues -- verify config, test send, resolve common errors.
epistemic-graph-troubleshooting
Diagnose and recover a live epistemic-graph engine (the AI-native database): engine down / socket refused, host-daemon crash-loop, circuit-breaker open, backend-type errors, zombie containers, duplicate Swarm tasks, slow first boot. Use when the KG is unreachable, ingestion stalls, go tools error, or a deploy left the…