Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bishopZ/2026-Boilerplate --skill migrate-ci-github-to-gitlabgit clone --depth 1 https://github.com/bishopZ/2026-BoilerplateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bishopz/2026-boilerplate/migrate-ci-github-to-gitlab)<a href="https://agentmods.dev/skills/bishopz/2026-boilerplate/migrate-ci-github-to-gitlab"><img src="https://agentmods.dev/badge/skills/bishopz/2026-boilerplate/migrate-ci-github-to-gitlab.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01762 |
| Opus 5 | $0.00023 | $0.00881 |
| Sonnet 5 | $0.00009 | $0.00352 |
| Haiku 4.5 | $0.00005 | $0.00176 |
Grade A, and why
migrate-ci-github-to-gitlab scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Start `npm run dev` in the **background**, poll with `curl` until the root URL returns HTTP success (same loop idea as Actions: ~60 attempts, ~2s sleep). How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migrate CI from GitHub Actions to GitLab
Use this skill when a task asks to move continuous integration off GitHub-specific workflow files onto GitLab CI/CD (.gitlab-ci.yml), or to drop .github/workflows in favor of a GitLab-hosted project.
Goal
- Remove GitHub Actions workflow definitions (and other GitHub-only CI glue that is no longer needed).
- Add a GitLab CI pipeline that matches the existing quality bar:
npm run lint,npm run type-check,npm run test:e2e(Playwright withwebServerauto-start; install browser binaries withnpx playwright install --with-deps chromium). - Keep no mandatory CI secrets for the default path (same idea as committed non-production env for the app under test).
- Update README, CONTRIBUTING, AGENTS.md (skills list), and CHANGELOG so contributors and agents are not pointed at GitHub-only instructions.
Preconditions
- Confirm the repo currently has (or recently had) GitHub Actions under
.github/workflows/(typicallyci.yml). If there is no Actions workflow yet, add GitLab CI from scratch using the same commands and env pattern below—no need to delete missing files. - Confirm
package-lock.jsonexists sonpm ciis valid in CI (this boilerplate expects it).
CI behavior to preserve
| Check | Command | Notes |
|---|---|---|
| Lint | npm run lint |
Node 24.x, npm ci |
| Typecheck | npm run type-check |
tsc --noEmit |
| E2E | npm run test:e2e |
Install Playwright browsers (npx playwright install --with-deps chromium), copy committed CI env → .env, run Playwright (webServer handles server lifecycle automatically) |
Env file: If the repository uses .github/ci.env, relocate it to a vendor-neutral path as part of migration (recommended: ci/ci.env) and reference that path from .gitlab-ci.yml. Update any remaining docs that linked to .github/ci.env.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 106 lines · 45 tokens per session scan A 8f6589fd3cce
migrate-ci-github-to-gitlab is a skill published in the GitHub repository bishopZ/2026-Boilerplate (24 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 1,762 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-task
Diagnose and fix moon tasks that are broken, misconfigured, or behaving unexpectedly. Use this skill when a moon task is failing, not running, skipped, hanging, producing stale or wrong output, cached when it shouldn't be, re-running every time when it should be cached, or when outputs are empty or missing after a…
turborepo
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines…
hunt-nodejs
Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, childprocess/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when…
node-inspect-debugger
Debug Node.js via --inspect + Chrome DevTools Protocol CLI.
npm-security
Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating packages or configuring package managers.
diagnosing-ci-and-merge-bottlenecks
Diagnoses CI and pull-request pipeline health for a GitHub repo using the engineering analytics MCP tools — pull-requests (PR list with CI status), workflow-health (per-workflow CI trends), and pr-lifecycle (a single PR's timeline). Use when asked whether CI is getting faster or slower, which GitHub Actions workflow…