Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arbazkhan971/godmode --skill ghactionsgit clone --depth 1 https://github.com/arbazkhan971/godmodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arbazkhan971/godmode/ghactions)<a href="https://agentmods.dev/skills/arbazkhan971/godmode/ghactions"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/ghactions.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 146 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.01653 |
| Opus 5 | $0.00028 | $0.00826 |
| Sonnet 5 | $0.00011 | $0.00331 |
| Haiku 4.5 | $0.00006 | $0.00165 |
Grade A, and why
ghactions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GHACTIONS — GitHub Actions Expert
Activate When
- User invokes
/godmode:ghactions - User says "create workflow", "add GitHub Actions"
- User says "matrix build", "reusable workflow"
- User mentions
.github/workflows/oraction.yml - Project needs CI/CD on GitHub Actions
Workflow
Step 1: Discover Repository Context
# Detect existing workflows
ls .github/workflows/*.yml 2>/dev/null
# Audit current actions
grep -rh "uses:" .github/workflows/ 2>/dev/null \
| sort -u
# Find unpinned actions (security risk)
grep -rn "uses:.*@v[0-9]" .github/workflows/ 2>/dev/null
# Find missing permissions declarations
grep -L "permissions:" .github/workflows/*.yml 2>/dev/null
# Find missing timeouts
grep -L "timeout-minutes:" .github/workflows/*.yml 2>/dev/null
REPOSITORY CONTEXT:
Workflows: <list>
Language: <detected>, Package Manager: <npm|pnpm>
Test: <jest|vitest|pytest>, Linter: <eslint|ruff>
Monorepo: yes/no, Environments: staging|production
IF no workflows: create from scratch
IF unpinned actions: pin to SHA immediately
IF missing permissions: add explicit per-job
IF missing timeouts: add to every job
Step 2: Triggers & Filtering
KEY TRIGGERS:
push (CI on merge), pull_request (PR checks)
schedule (nightly), workflow_dispatch (manual)
workflow_call (reusable), release (publish)
RULES:
Use paths/paths-ignore to skip irrelevant workflows
IF docs-only change: skip test workflow
IF monorepo: trigger per-package via paths
Step 3: Job Structure & Matrix
jobs:
lint:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@<SHA>
- uses: actions/setup-node@<SHA>
with: { node-version: '20', cache: 'npm' }
- run: npm ci && npm run lint
test:
needs: lint
runs-on: ${{ matrix.os }}
timeout-minutes: 15
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest]
node-version: [18, 20, 22]
Step 4: Caching & Optimization
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 234 lines · 57 tokens per session scan A c724caf27789
ghactions is a skill published in the GitHub repository arbazkhan971/godmode (26 stars, last pushed 10d ago), licensed MIT. It adds 57 tokens to every session and 1,653 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
gh-fix-ci
Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use gh to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL.
dev-branch-deploy
Drive the Hermes/Maia Concourse dev-branch deploy workflow — test stack changes in a live lab before merging to master. Use for "dev branch", "deploy to dev", "hermes-dev-branch", "maia-dev-branch", "test in labs", "dev lane". Covers both the hermes and maia stacks.
ci-cd-patterns
CI/CD: GitHub Actions, GitLab CI, Jenkins, caching, blue-green, canary. Triggers: CI, CD, pipeline, GitHub Actions, workflow YAML, release, canary, rollout.
squid-implement-night
Run the full agent-team pipeline end-to-end for one feature whose Tasks Plan is already approved by /squid-plan, handing the human a validated, ready-to-squash-merge PR. Trigger after /squid-plan.
ci
Detect/generate/debug CI pipeline config (GitHub Actions, GitLab CI). Triggers: CI setup, build pipeline, GitHub Actions config, debug CI, GitLab CI.
squid-review-ci
Drive CI green on a pushed, review-clean feature PR — On-Call diagnoses failures and hands fix tasks to the SWE. Output: a CI-validated feature PR. Trigger after /squid-review passes.