Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bendrucker/claude --skill ci-monitorgit clone --depth 1 https://github.com/bendrucker/claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bendrucker/claude/ci-monitor)<a href="https://agentmods.dev/skills/bendrucker/claude/ci-monitor"><img src="https://agentmods.dev/badge/skills/bendrucker/claude/ci-monitor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bendrucker/claude/ci-monitor"><img src="https://agentmods.dev/badge/skills/bendrucker/claude/ci-monitor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.01736 |
| Opus 5.5 | $0.00024 | $0.00694 |
| Sonnet 5.5 | $0.00012 | $0.00347 |
| Haiku 4.5 | $0.00006 | $0.00174 |
Grade A, and why
gitlab:ci-monitor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI Monitor
Watch a GitLab pipeline (for an MR, a branch, or a specific pipeline ID), reacting to failures by dispatching the gitlab:logs agent for diagnostics. Exits cleanly when the pipeline is green, the MR is closed, a pipeline-id target reaches a terminal status, or the wall-clock cap is hit.
Target
$ARGUMENTS
Accepts an MR URL, a branch name, a pipeline ID, or derives one from the current branch:
- MR mode: pass a URL like
https://gitlab.com/group/project/-/merge_requests/123. - Branch mode: pass a branch name (e.g.
main, a release branch). Project pathgroup/projectis inferred fromgit remote get-url originin the current directory; pass--project <group/project>to override. - Pipeline-id mode: pass a pipeline ID (e.g. from a manually-triggered pipeline or a re-run). Project is inferred from the git remote; override with
--project <group/project>. - No argument: derive an MR URL from the current branch:
glab mr view --output json | jq -r '.web_url'.
Workflow
Start the monitor
Launch the watch script via the Monitor tool with persistent: true:
- MR mode:
bun ${CLAUDE_SKILL_DIR}/scripts/watch.ts --mr <mr-url> - Branch mode:
bun ${CLAUDE_SKILL_DIR}/scripts/watch.ts --branch <name> [--project <group/project>] - Pipeline-id mode:
bun ${CLAUDE_SKILL_DIR}/scripts/watch.ts --pipeline-id <id> [--project <group/project>] - Optional flags:
--interval <seconds>,--max-minutes <N>,--queued-timeout <minutes>,--api-error-threshold <N>.
Exactly one of --mr, --branch, or --pipeline-id is required. In branch and pipeline-id modes, --project is inferred from the current git remote when omitted. Pipeline-id mode queries glab api projects/:id/pipelines/:pid directly; if the pipeline does not exist the watcher exits non-zero on the first call.
MR mode resolves the pipeline from projects/:id/merge_requests/:iid/pipelines and branch mode from projects/:id/pipelines?ref=<branch>. Both ignore external pipelines (commit statuses posted by other tools, which carry no CI jobs) and parent_pipeline pipelines (children the parent already aggregates), and each prefers its own kind: merge_request_event in MR mode, branch pipelines in branch mode.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago Changed d3cb21b09395
- 1mo ago Changed · -1 lines f44f16931d65
- 1mo ago First seen · 113 lines · 59 tokens per session scan A 3e77e47e75ee
gitlab:ci-monitor is a skill published in the GitHub repository bendrucker/claude (18 stars, last pushed today), licensed MIT. It adds 59 tokens to every session and 1,736 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cloudflare-workers-testing
Comprehensive testing guide for Cloudflare Workers using Vitest and @cloudflare/vitest-pool-workers. Use for test setup, binding mocks (D1/KV/R2/DO), integration tests, or encountering test failures, mock errors, coverage issues.
cicd-integration
Generate CI pipeline files and check scripts (GitHub Actions, GitLab, CircleCI, Bitbucket) that automate design system checks: token validation, hardcoded values, a11y scans, visual regression, bundle size. Trigger: set up CI, quality gates, automate these checks. Not for running an audit.
vibe-safe-deploy
Performs deployment with pre-flight checks, atomic replacement, post-deploy verification, provenance (proving the environment serves the exact commit you pushed), and automatic rollback. Use before any deployment to staging, preview, or production.
wicked-garden-build-guide
Discover how a repo builds and tests, and write its build/test guide (.wicked/build-guide.json, contract v1): the data the wicked-core floor interprets instead of hardcoding runners. Reads CI config first, then the manifests, then each runner's own --version and --help. Prefers structured results (JUnit; JSON lines…
wicked-garden-platform-security-engineer
Security scanning and vulnerability assessment from DevSecOps perspective. Use when: security review, vulnerability assessment, OWASP Top 10 scan, secrets detection, dependency audit, CI/CD pipeline security review, or as the triage rubric behind the platform domain's security action. NOT THIS WHEN: a scenario-driven…
wicked-garden-platform-gate-benchmark-rebaseline
Re-baseline procedure for the AC-11 gate-result benchmark lane (tests/crew/testgateresultbenchmark.py). The benchmark enforces a 2× p95 SLO on gate-result.json ingestion. When a deliberate perf change lands on main (validator hardening, cache tuning, schema expansion), the baseline needs updating. Never re-baseline to…