Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/carta/plugins/update-investornpx skills add carta/plugins --skill update-investorgit clone --depth 1 https://github.com/carta/pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/carta/plugins/update-investor)<a href="https://agentmods.dev/skills/carta/plugins/update-investor"><img src="https://agentmods.dev/badge/skills/carta/plugins/update-investor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00095 | $0.00915 |
| Opus 5 | $0.00048 | $0.00458 |
| Sonnet 5 | $0.00019 | $0.00183 |
| Haiku 4.5 | $0.00010 | $0.00092 |
Grade A, and why
update-investor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to update-company — 55 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
Partially update an existing investor. Only fields provided are modified — this is a partial update, not a replacement. First resolve the investor ID, collect what to change, then call the update tool.
Step 1 — Resolve the investor ID
If the user provided an investor ID directly, use it and skip to Step 3.
If only a name or description was given, search first:
crm_call_tool({ "name": "crm:search_investors", "arguments": { query: "<name>", limit: 10 } })
If multiple investors match, present the list and ask the user to confirm which one to update (show name and ID for each).
Step 2 — Collect what to update
Ask the user what they want to change:
- name — investor firm name
- fields — custom field values keyed by field ID (e.g. website, location, industry, about, tags)
If the user wants to update custom fields but isn't sure of field IDs, fetch the schema first:
crm_call_tool({ "name": "crm:get_investor_custom_fields", "arguments": {} })
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 94 lines · 95 tokens per session scan A df74a6ca90f3
update-investor is a skill published in the GitHub repository carta/plugins (12 stars, last pushed yesterday), licensed Apache-2.0. It adds 95 tokens to every session and 915 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. It is 86% identical to update-company, differing in 55 lines, and is treated as a copy.
Other skills, from other repositories
release
Release a new version of the DevoxxGenie IntelliJ plugin — prompt for the target version, bump it in the build files, write a curated CHANGELOG.md entry and plugin.xml change-notes from the git/PR history since the last tag, build to verify, then commit, tag, and publish a matching GitHub release. Use this whenever…
aspire
Build, upgrade, and operate Aspire 13.5.x C# or TypeScript application hosts with the current CLI, AppHost, ServiceDefaults, integrations, dashboard, testing, MCP, and deployment patterns for distributed apps. USE FOR: Aspire.AppHost.Sdk, Aspire.Hosting., DistributedApplication.CreateBuilder, apphost.mts…
microsoft-agent-framework
Build .NET AI agents, harnesses, and multi-agent workflows with Microsoft Agent Framework using the right agent type, sessions, tools, workflows, hosting protocols, and enterprise guardrails. USE FOR: building or reviewing .NET code that uses Microsoft.Agents., Microsoft.Extensions.AI, AIAgent, HarnessAgent…
wpf
Build and modernize WPF applications on .NET with correct XAML, data binding, commands, threading, styling, and Windows desktop migration decisions. USE FOR: working on WPF UI, MVVM, binding, commands, or desktop modernization; migrating WPF from .NET Framework to .NET; integrating newer Windows capabilities into a…
worker-services
Build long-running .NET background services with BackgroundService, Generic Host, graceful shutdown, configuration, logging, and deployment patterns suited to workers and daemons. USE FOR: background services; scheduled workers; hosted services; worker extraction; graceful shutdown, health checks, and service hosting…
mcp
Build or consume Model Context Protocol (MCP) servers and clients in .NET using the official MCP C# SDK, including stdio, Streamable HTTP, tools, prompts, resources, and capability negotiation. USE FOR: .NET MCP servers or clients; stdio versus HTTP transport choices; tools, resources, prompts, completions, and…