Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add avenoxai/avenoxskills --skill gptprogit clone --depth 1 https://github.com/avenoxai/avenoxskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/avenoxai/avenoxskills/gptpro)<a href="https://agentmods.dev/skills/avenoxai/avenoxskills/gptpro"><img src="https://agentmods.dev/badge/skills/avenoxai/avenoxskills/gptpro.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01273 |
| Opus 5 | $0.00051 | $0.00636 |
| Sonnet 5 | $0.00020 | $0.00255 |
| Haiku 4.5 | $0.00010 | $0.00127 |
Grade A, and why
gptpro scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GPTPro Export
Package a monorepo into clean, logically-split zip bundles for review by a powerful non-agentic model — GPT Pro on the ChatGPT web UI, or any chat model you upload files to.
That model has no shell, no live filesystem, and a bounded context. So we split
by subsystem and strip node_modules, build output, binary assets, and secrets
— giving it something it can actually navigate instead of a 400MB tarball it
will choke on.
Run it with no config
PROJECT_ROOT=/path/to/repo ./scripts/export.sh
With no bundles.conf, the script autodetects: one bundle per workspace package
(apps/*, packages/*, services/*, libs/*), a schema-only db bundle from
whatever migrations directory exists, and a docs bundle. A single-package repo
gets one src bundle instead of the workspace walk.
That gets you a usable split on the first run. A hand-written config gets you a good one — the model navigates by asking "which bundle would this live in", so a split that matches your architecture is worth writing.
Configure
Bundles are defined in bundles.conf, which overrides autodetect entirely.
Copy the example and edit:
cp bundles.example.conf bundles.conf
Each line declares one bundle:
define_bundle <name> "<description>" <source>...
Sources are dir:<path> or file:<path>[:<subdir>], relative to the repo root:
define_bundle core "domain logic — the most important bundle for architecture review" \
dir:packages/core
define_bundle db "schema architecture only — no rows, no seed data" \
dir:supabase/migrations \
file:supabase/config.toml:supabase \
file:docs/DB_PLAN.md
define_bundle docs "architecture and convention context" \
dir:docs dir:adrs file:README.md file:AGENTS.md
Run
./scripts/export.sh
Overrides:
PROJECT_ROOT=/path/to/repo \
OUTPUT_DIR=~/Desktop/review-bundles \
BUNDLE_PREFIX=myproject \
./scripts/export.sh
| Variable | Default | Meaning |
|---|---|---|
PROJECT_ROOT |
$PWD |
repo to export |
OUTPUT_DIR |
./gptpro-bundles |
where zips land (upload folder) |
BUNDLE_PREFIX |
repo dir name | zip name prefix → <prefix>-core.zip |
BUNDLES_CONF |
bundles.conf next to the script |
bundle definitions; autodetect if absent |
ALLOW_SECRETS |
0 |
1 continues past a hard secret-scan hit |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 127 lines · 102 tokens per session scan A 734e00697097
gptpro is a skill published in the GitHub repository avenoxai/avenoxskills (48 stars, last pushed 1mo ago), licensed MIT. It adds 102 tokens to every session and 1,273 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
impl-validator
Validate whether an implementation matches its stated goal. Use this skill when a skill or agent wants a second opinion on its own output, when the user says "check this implementation", "validate what you did", "is this correct?", "review the output", or "did you do this right?". Also spawned automatically as a…
codeql
Run CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF. Use when CodeQL is explicitly requested; use security-review for a broader manual security review.
hf-cloud-sagemaker-production-defaults
Implement a production SageMaker endpoint with autoscaling, CloudWatch alarms, and tags. Use after the serving image and IAM role are known; use the deployment planner first when architecture is undecided.
sarif-parsing
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT…
security-review
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issues before merging.…
code-review
Review a pull request or a set of code changes for bugs, logic errors, and project-convention violations using a confidence-filtered, multi-agent process. Use this skill when the user asks to review a PR, audit pending changes, or inspect a diff for problems before merging.