Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/aotter/mantle/updatenpx skills add aotter/mantle --skill updategit clone --depth 1 https://github.com/aotter/mantleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.00723 |
| Opus 5 | $0.00012 | $0.00362 |
| Sonnet 5 | $0.00005 | $0.00145 |
| Haiku 4.5 | $0.00002 | $0.00072 |
Grade A, and why
update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mantle Update
Use this for drift checks. Do not blindly overwrite user-owned code.
First Read
package.jsonand lockfile for installed@aotter/mantle*versions..mantle/launch-state.jsonand.mantle/features.jsonwhen the project came from Mantle landing..mantle/plugins.jsonand.mantle/plugins.lock.jsonwhen plugins are installed.- Existing project scripts such as
mantle:update,validate, andtypecheck; the installedmantle updatecommand is authoritative.
Workflow
- Start from a clean git worktree.
- Resolve a mutable target branch to its current commit SHA, then run the installed command with that immutable ref:
pnpm exec mantle update --ref <immutable-ref>
For the one-time alpha.63 bridge, invoke the exact newer Core package and provide the current bundle location because alpha.63 metadata does not contain it:
pnpm dlx @aotter/mantle@<exact-version> update \
--ref <immutable-ref> \
--bundle-base-url 'https://raw.githubusercontent.com/aotter/mantle-starters/{ref}/provision-bundles'
Do not extract or replace a repo-local updater. The Core command accepts
the alpha.63 no-v source ref, writes only the report, and records the
versioned bundle location for the reviewed metadata migration.
3. Read the generated report before editing.
4. Triage each path; do not treat the report as a patch or merge plan.
5. Port confirmed upstream changes one hunk at a time.
6. Apply only the report's .mantle/launch-state.json and
.mantle/features.json metadata migration, preserving every other field.
7. Re-run:
pnpm validate
pnpm typecheck
Report Triage
Current reports compare three states: the original starter ref, the target ref, and the local project.
- Review
upstreamto find starter changes worth porting. Uselocalonly to understand project-owned drift from the original starter. - Never copy generated comparison versions of
.mantle/launch-state.jsonor.mantle/features.json; the report omits them and gives a field-level migration instead. Preserve Worker/D1 names, bindings, origins, provider values, and all unlisted launch state. - The updater reproduces project identity in legacy Wrangler files. If
upstreamproposesmantle-<type>names for a real project, stop: the bundle is incompatible and must not be ported. - A large
localsection is normal after customization. Counts are not a confidence score.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 82 lines · 23 tokens per session scan A 4b47cd8260cc
update is a skill published in the GitHub repository aotter/mantle (4 stars, last pushed 7d ago), licensed Apache-2.0. It adds 23 tokens to every session and 723 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ic-feedback
Submit feedback, feature requests, praise, complaints, questions, suggestions, or breakage reports to the Immersive Commons operator on a user's behalf. Available to EVERY tier (public through operator) — no token required for the REST path. Use when the user says "I wish IC had X", "the kiosk is broken", "this doc is…
ic-events-stream
Teach a member's AI agent to subscribe to the Immersive Commons agentic event log and route notifications itself — tier decisions, inbox envelopes, and more as IC adds append sites. IC publishes "things happening for me" events; the agent polls, then decides routing (Telegram / Slack / toast / auto-act / nothing) on…
ic-onboarding
Set an agent's human user up on Immersive Commons end-to-end, explaining every step to them in plain English — mint a token, install + verify the MCP server, set their profile, EDUCATE them on everything IC offers, and file a quality tier-upgrade request. Use when the human says "set me up on IC", "connect me to…
zai-keys
Request and use a Z.ai (GLM) Claude-Code-compatible key from Immersive Commons — a 5-hour walk-in WORKSHOP pass (public tier, tied to an event) or a weekly-token MEMBER key (ic-member, pick a multiplier). Use when the human says "get me a Z.ai key", "I need a GLM key for the workshop", "set up Claude Code on the IC…
ic-leaderboard
Connect a user's GitHub account to the Immersive Commons commits leaderboard, opt them in, and verify their rank. Use when the human says "put me on the leaderboard", "get me on /floor10/commits", "connect my GitHub to IC", "show me my leaderboard rank", or "opt me out of the commits board". Requires an IC agent token…
ic-operator-admin
Walk an Immersive Commons operator's agent through the pending-membership review queue end-to-end — list waiting requests, decide approve / deny / override, run a dry-run preview, then commit. Hard rules around evidence-before-decision, no batch approvals, no self-promotion. Use when the human says "review pending IC…