Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arbazkhan971/godmode --skill monorepogit clone --depth 1 https://github.com/arbazkhan971/godmodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arbazkhan971/godmode/monorepo)<a href="https://agentmods.dev/skills/arbazkhan971/godmode/monorepo"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/monorepo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arbazkhan971/godmode/monorepo"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/monorepo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 124 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 65 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 66 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 72 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00996 |
| Opus 5 | $0.00014 | $0.00498 |
| Sonnet 5 | $0.00006 | $0.00199 |
| Haiku 4.5 | $0.00003 | $0.00100 |
Grade A, and why
monorepo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Activate When
/godmode:monorepo, "monorepo", "workspace setup"- "selective builds", "dependency graph", "boundaries"
- Multi-package project with slow CI or tangled deps
Workflow
1. Assessment
ls turbo.json nx.json lerna.json \
pnpm-workspace.yaml 2>/dev/null
find . -name "package.json" -maxdepth 3 | wc -l
Packages: <N> | Languages: <list>
Build tool: <current|none>
Package manager: <npm|pnpm|yarn|bun>
CI time: <N min> full / <N min> affected
Boundary violations: <N> | Circular deps: <N>
2. Tool Selection
Turborepo: zero-config caching, simple. JS/TS.
Learning: LOW.
Nx: rich plugins, codegen, dep graph UI.
Enterprise, large. Learning: MEDIUM.
Lerna: publishing workflow, changelogs.
npm package authors. Learning: LOW.
Bazel: language-agnostic, hermetic.
Google-scale. Learning: HIGH.
Rush: strict dep management, phantom prevention.
Learning: MEDIUM-HIGH.
IF multi-language: Bazel or Nx custom executors. IF prefer minimal config: Turborepo + pnpm. IF publishing npm packages: Lerna + pnpm.
3. Package Structure
<repo>/
apps/ # Deployable applications
packages/ # Shared libraries
tools/ # Build tools, scripts
package.json, turbo.json/nx.json
Naming: @<org>/<package>, lowercase kebab-case.
Apps: "private": true. Packages: publishable.
4. Boundary Enforcement
- apps/ can import packages/ (ALLOWED)
- packages/ can import packages/ if declared
- apps/ CANNOT import other apps/ (BLOCKED)
- packages/ CANNOT import apps/ (BLOCKED)
- No circular dependencies (BLOCKED)
5. Selective Builds & Caching
npx turbo run build --filter=...[origin/main]
npx nx affected --target=build --base=origin/main
Remote caching: Turborepo (Vercel) or Nx Cloud. Impact: 15-min build -> 30 seconds with cache hit.
6. Dependency Graph Health
Visualize: turbo run build --graph or npx nx graph.
Fix: circular deps -> extract shared package.
Hub packages (>5 dependents) -> split.
Orphan packages (0 dependents) -> remove.
Deep chains (4+ levels) -> flatten.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 133 lines · 28 tokens per session scan A 927b90a23db1
monorepo is a skill published in the GitHub repository arbazkhan971/godmode (26 stars, last pushed 12d ago), licensed MIT. It adds 28 tokens to every session and 996 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
utility-pm-skill-iterate
Applies targeted improvements to an existing pm-skills skill based on feedback, validation reports, or convention changes. Reads current files, previews proposed changes, writes on confirmation, and suggests a version bump. Use when improving a skill after validation or feedback.
speckit-workflow
Comprehensive understanding of the spec-kit methodology. Constitution-driven feature development with specify, plan, tasks, and implement phases.
reddit-moderate
Reddit moderation via PRAW: fetch modqueue, classify reports, take actions.
om-auto-fix-issue
Fix or implement a tracker issue end to end from a single command — takes an issue id or a plain problem description (filed first via om-prepare-issue), classifies, then drives the bug autofix chain (om-verify-in-repo, om-root-cause, om-fix, om-open-pr, om-auto-review-pr, om-auto-qa-pr for UI fixes) or the feature…
plan
Breaks features/goals into phased plans with task lists, agent assignments, dependencies. Triggers: plan feature, implementation roadmap, break down task, project phases.
foundation-okr-writer
Drafts, reviews, rewrites, and coaches outcome-based OKR sets across team, department, product, or company scopes. Supports five entry modes (Guided default, One-Shot via --oneshot, Sustained Coach, Audit Only, Rewrite). Diagnoses empowered-team context and adjusts framing; refuses to fabricate baselines or targets…