Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add besoeasy/open-skills --skill bulk-github-stargit clone --depth 1 https://github.com/besoeasy/open-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/besoeasy/open-skills/bulk-github-star)<a href="https://agentmods.dev/skills/besoeasy/open-skills/bulk-github-star"><img src="https://agentmods.dev/badge/skills/besoeasy/open-skills/bulk-github-star/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/besoeasy/open-skills/bulk-github-star"><img src="https://agentmods.dev/badge/skills/besoeasy/open-skills/bulk-github-star.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 26 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01003 |
| Opus 5.5 | $0.00018 | $0.00401 |
| Sonnet 5.5 | $0.00009 | $0.00201 |
| Haiku 4.5 | $0.00005 | $0.00100 |
Grade B, and why
bulk-github-star scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt-get install -y gh Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const { execSync } = require('child_process'); How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bulk GitHub Repository Starring
Automate starring all public repositories from any GitHub user with a single command.
When to use
- User asks to star all repos from a specific GitHub user
- Bulk appreciation for open source contributors
- Discovering and saving all projects from a creator
- Automation workflows for GitHub engagement
Required tools / APIs
- GitHub CLI (
gh) with authentication - No external API keys required (uses GitHub CLI token)
Install GitHub CLI:
# Ubuntu/Debian
sudo apt-get install -y gh
# macOS
brew install gh
# Alpine (Docker)
apk add github-cli
# Login required
gh auth login
Skills
star_all_user_repos
Star all public repositories from a GitHub user.
# Star all repos from a user
USER="besoeasy"
repos=$(gh repo list $USER --limit 100 | grep "^$USER/" | cut -f1)
for repo in $repos; do
echo "Starring: $repo"
gh api -X PUT /user/starred/$repo
done
echo "Starred $(echo "$repos" | wc -l) repositories"
Node.js:
async function starAllUserRepos(username) {
const { execSync } = require('child_process');
// Get all repos for user
const output = execSync(`gh repo list ${username} --limit 100 --json nameWithOwner`, { encoding: 'utf8' });
const repos = JSON.parse(output);
let starred = 0;
for (const repo of repos) {
const [owner, name] = repo.nameWithOwner.split('/');
try {
execSync(`gh api -X PUT /user/starred/${owner}/${name}`, { stdio: 'inherit' });
console.log(`✓ Starred: ${repo.nameWithOwner}`);
starred++;
} catch (err) {
console.error(`✗ Failed to star ${repo.nameWithOwner}:`, err.message);
}
}
console.log(`\nCompleted: ${starred}/${repos.length} repositories starred`);
return starred;
}
// Usage
// starAllUserRepos('besoeasy');
star_with_filter
Star repos matching specific criteria (e.g., stars threshold, topic).
# Star only repos with >100 stars
USER="besoeasy"
MIN_STARS=100
gh repo list $USER --limit 100 --json nameWithOwner,stargazerCount | \
jq -r ".[] | select(.stargazerCount >= $MIN_STARS) | .nameWithOwner" | \
while read repo; do
echo "Starring: $repo ($(gh api /repos/$repo | jq -r '.stargazers_count') stars)"
gh api -X PUT /user/starred/$repo
done
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 145 lines · 45 tokens per session scan B 6efc83839c4d
bulk-github-star is a skill published in the GitHub repository besoeasy/open-skills (132 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 1,003 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
github
Use when interacting with GitHub repositories, authentication, remotes, pushes, or repository creation through the GitHub CLI and related git workflows.
git-workflow
Git workflow patterns including branching strategies, commit conventions, merge vs rebase, conflict resolution, and collaborative development best practices for teams of all sizes.
run-work
Execute a work unit end-to-end: sequence tasks by dependency, implement, test between tasks, commit, and track progress. Use to deliver a complete feature in one session. Invoked as /agiflow:run-work . Uses getworkunit, listtasks, updatetask, getworkunitprogress.
writing-modpack-changelog
Use when cutting a modpack release. Creates /docs/release-changelog.md if absent; appends a new version section with grouped changes. Triggers - 'cut a release', 'release notes', 'changelog', 'v1.2.3 changes', 'what changed since last version'.
moai-workflow-worktree
Git worktree management for parallel SPEC development with isolated workspaces, automatic branch registration, and seamless MoAI-ADK integration. Use when setting up parallel development environments.