Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/buddyh/agent-skills/alexa-clinpx skills add buddyh/agent-skills --skill alexa-cligit clone --depth 1 https://github.com/buddyh/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/buddyh/agent-skills/alexa-cli)<a href="https://agentmods.dev/skills/buddyh/agent-skills/alexa-cli"><img src="https://agentmods.dev/badge/skills/buddyh/agent-skills/alexa-cli.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00052 | $0.00454 |
| Opus 5 | $0.00026 | $0.00227 |
| Sonnet 5 | $0.00010 | $0.00091 |
| Haiku 4.5 | $0.00005 | $0.00045 |
Grade A, and why
alexa-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Alexa CLI
Control Echo devices via the alexacli command.
Requirements
Install from: https://github.com/buddyh/alexa-cli
brew install buddyh/tap/alexacli
# or
go install github.com/buddyh/alexa-cli/cmd/alexa@latest
Commands
# List devices
alexacli devices
# Text-to-speech
alexacli speak "Hello" -d Kitchen # Specific device
alexacli speak "Dinner is ready!" --announce # ALL devices
# Voice commands (smart home, music, etc.)
alexacli command "turn off the lights" -d Kitchen
alexacli command "set thermostat to 72" -d Kitchen
alexacli command "play jazz" -d "Living Room"
alexacli command "set timer 10 minutes" -d Office
# Ask and get response back
alexacli ask "what's the temperature" -d Kitchen
alexacli ask "what's on my calendar" -d Kitchen
# History
alexacli history
alexacli history --limit 5
# Routines (WIP)
alexacli routine list
alexacli routine run "Good Night"
# Smart home direct control (WIP)
alexacli sh list
alexacli sh on "Kitchen Light"
alexacli sh off "All Lights"
JSON Output
All commands support --json:
alexacli devices --json
alexacli ask "what time is it" -d Kitchen --json
Notes
- Device names support partial, case-insensitive matching
commandis preferred for smart home - natural language is more flexibleaskretrieves Alexa's actual response (useful for queries)- Uses unofficial Amazon API (same as Alexa app)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 69 lines · 52 tokens per session scan A baab7edf9ee3
alexa-cli is a skill published in the GitHub repository buddyh/agent-skills (5 stars, last pushed 29d ago), licensed MIT. It adds 52 tokens to every session and 454 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
developer-device-platform-basics
Provides guidance and instructions on managing remote devices on Developer Device Platform (DDP). Use when reserving remote Android devices, establishing connection tunnels, checking session status, or extending/cancelling leases. Don't use for iOS or local device/hardware inquiries.
camerax
Provide technical guidance for Android camera development with CameraX. Use when implementing camera features, handling asynchronous recording lifecycles, wiring low-level hardware interop using CameraX, or integrating ML Kit or Media3 effects.
offensive-iot
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential…
testing-ics-ot-protocols
Test Industrial Control Systems and Operational Technology protocols — Modbus, DNP3, OPC UA, BACnet, EtherNet/IP, S7comm, MQTT — with safety-first methodology for SCADA and ICS environments. Use when assessing OT network security, testing ICS protocol authentication, reviewing IT-OT segmentation, or performing…
hz-unity-meta-movement-sdk-retargeting
Set up and tweak Meta Movement SDK (MSDK) retargeting for a character model. Use this whenever the user wants to retarget a humanoid FBX/prefab for Meta Quest body tracking, generate a retargeting config, or hand-edit the resulting .json (fix known-joint mappings, exclude joints from auto-mapping, rename target…
analyzing-binaries
Reverse engineer compiled binaries, firmware, and mobile app packages using triage, static disassembly, decompilation, and dynamic instrumentation. Use when analyzing an executable, ELF/PE/Mach-O file, firmware image, or stripped binary, recovering an algorithm or protocol, or working a CTF reversing challenge.