Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Aperivue/medsci-skills --skill contributegit clone --depth 1 https://github.com/Aperivue/medsci-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aperivue/medsci-skills/contribute)<a href="https://agentmods.dev/skills/aperivue/medsci-skills/contribute"><img src="https://agentmods.dev/badge/skills/aperivue/medsci-skills/contribute/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aperivue/medsci-skills/contribute"><img src="https://agentmods.dev/badge/skills/aperivue/medsci-skills/contribute.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02299 |
| Opus 5.5 | $0.00022 | $0.00920 |
| Sonnet 5.5 | $0.00011 | $0.00460 |
| Haiku 4.5 | $0.00006 | $0.00230 |
Grade A, and why
contribute scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 183 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Contribute
The user is a clinician who has probably never opened a pull request. Do the git work for them: never make them type a git command, and never use the words "rebase", "upstream", or "HEAD" in anything they read. Their local edits sit next to real patients and real manuscripts, so the safety steps below, not the git mechanics, are why this is a skill.
The one rule that cannot bend
Nothing leaves the machine until the author has seen every line that would leave it and said yes. Until something has been sent, say explicitly, every time, that nothing has been sent.
The safety scan is an aid, not a certificate: no pattern list recognises every patient name or every hospital. Say so out loud, because a user who believes the scanner is complete stops reading the diff, and that is exactly when the leak happens.
If the scan reports a blocker (patient-level data, a credential), do not offer a workaround. The line gets deleted. A contribution never needs patient data to make its point.
Phase 0: What did they change?
python3 "${CLAUDE_SKILL_DIR}/scripts/find_local_changes.py" --target claude --json \
--out qc/local_changes.json
This compares the installed skills against the hashes of what was shipped. It reads only.
- Nothing changed → say so plainly and stop; that is normal, not a failure. Offer the feedback path (Phase 4) instead.
- Something changed → show it, grouped by skill:
- A new file (a journal profile, a citation style, a reporting exemplar) — usually the most valuable kind of contribution, because it is domain knowledge nobody in the project has. Say that.
- An edited file — ask what was wrong for their specialty; the answer is the pull-request description. Never guess at the reason for an edit.
- A deleted file — usually not a contribution. Ask before including it.
A change that only makes sense in one hospital (internal rules, a template with the department's letterhead) is a local adaptation, not a contribution: say so, leave it out, and tell them keeping it is fine.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +15 lines 309c4e108127
- 25d ago Changed · -59 lines · -40 tokens per session c2818aec31cf
- 1mo ago First seen · 227 lines · 95 tokens per session scan A 776b8d639400
contribute is a skill published in the GitHub repository Aperivue/medsci-skills (349 stars, last pushed yesterday), licensed MIT. It adds 55 tokens to every session and 2,299 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
datalad
Retrieves, versions, and publishes scientific datasets with DataLad and git-annex, and captures computational provenance with datalad run, rerun, and containers-run. Use when cloning or fetching data from OpenNeuro, DANDI, datasets.datalad.org, or any DataLad dataset; when a file in a dataset reads as a broken symlink…
pr-squash-message
Generate one short Conventional Commits squash message describing only the net diff between the PR's base and head, set its header as the PR title, validate it with the repository's commitlint and both copy its description to the clipboard and display it, when asked for a squash message. Works in any Scenario…
ship
Pre-release gate. Run the full gate, responsive + render checks, then produce the release checklist (README badge/current/changelog). Use before tagging a release.
git-workflow
A guide for handling Git repository work safely, including status checks, branches, commits, pushes, pull requests, and rebasing. Git is a version-control system that records code changes and coordinates work between developers.
git-workflow
Guided git workflows: prepare PRs, clean up branches, resolve merge conflicts, handle monorepo tags, squash-and-merge patterns. Use when asked to prepare a PR, clean branches, resolve conflicts, or tag a release.
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.