Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add antropos17/Aegis --skill shipgit clone --depth 1 https://github.com/antropos17/AegisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/antropos17/aegis/ship)<a href="https://agentmods.dev/skills/antropos17/aegis/ship"><img src="https://agentmods.dev/badge/skills/antropos17/aegis/ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/antropos17/aegis/ship"><img src="https://agentmods.dev/badge/skills/antropos17/aegis/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00264 |
| Opus 5.5 | $0.00012 | $0.00106 |
| Sonnet 5.5 | $0.00006 | $0.00053 |
| Haiku 4.5 | $0.00003 | $0.00026 |
Grade A, and why
ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Ship AEGIS
Use the active session's authorization and the selected checkout's AGENTS.md.
The canonical PR/merge procedure is
docs/development/workflow.md#git-and-pr-cycle; commit-and-track handles staging
and commit/push details, and ci-monitor interprets the current PR's checks.
Review the final diff and create or update one focused PR with the resulting
behavior and actual validation. Avoid empty or duplicate PRs. A request limited
to preparing a PR ends at that boundary. For an authorized merge, wait for every
required context on the current revision, keep master current by merging when
needed and use the verified head with --match-head-commit. Never bypass checks
with --admin. Follow the workflow's occupied-master/worktree procedure.
Verify and report the resulting PR and merge state. A merge does not establish installation or deployment. Release tags, force pushes, lockfile regeneration and protected configuration retain the boundaries in AGENTS.md. If installation is explicitly requested, identify the destination, preserve its app/profile, verify the package and inspect the installed executable and shortcuts.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 25 lines · 29 tokens per session scan A 61a27f61690d
ship is a skill published in the GitHub repository antropos17/Aegis (157 stars, last pushed today), licensed MIT. It adds 29 tokens to every session and 264 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-17.
Other skills, from other repositories
update-skills
Create or update repository skills and instructions when major learnings are discovered during a session. Use when the user says "learn!", when a significant pattern or pitfall is identified, or when reusable domain knowledge should be captured for future sessions.
github-copilot-upgrader
Use this to update the Github Copilot CLI/SDK.
commit
Commit staged or unstaged changes with an AI-generated commit message that matches the repository's existing commit style. Use when the user asks to 'commit', 'commit changes', 'create a commit', 'save my work', or 'check in code'.
sync
Sync the current session branch with its upstream branch, or publish the current session branch to a remote. Use when the user asks to sync a branch, pull latest changes, rebase onto upstream, push current branch, publish branch, or set upstream.
merge
Merge changes from the topic branch to the merge base branch. Use when the user wants to merge their session's work back to the base branch.
sync-upstream
Update a stale session branch by rebasing onto the latest origin. Use when the upstream has moved significantly and the session needs to catch up, resolving conflicts by preserving upstream changes and adapting session work to fit.