Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ccfos/nightingale/modify-task-tplnpx skills add ccfos/nightingale --skill modify-task-tplgit clone --depth 1 https://github.com/ccfos/nightingaleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccfos/nightingale/modify-task-tpl)<a href="https://agentmods.dev/skills/ccfos/nightingale/modify-task-tpl"><img src="https://agentmods.dev/badge/skills/ccfos/nightingale/modify-task-tpl.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00168 | $0.07747 |
| Opus 5 | $0.00084 | $0.03874 |
| Sonnet 5 | $0.00034 | $0.01549 |
| Haiku 4.5 | $0.00017 | $0.00775 |
Grade E, and why
modify-task-tpl scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
| `curl <non-whitelisted URL> \| sh`, `wget ... -O - \| bash` | Remote code injection | Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
| `rm -rf /` / `rm -rf /*` / `rm -rf $UNSET_VAR/` | Wipes the entire disk | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `curl <non-whitelisted URL> \| sh`, `wget ... -O - \| bash` | Remote code injection | How it starts
The opening of the file, as written. The whole thing — 733 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nightingale (n9e) Alert Self-Healing Script (task_tpl) Generation
Nightingale alert self-healing is the ibex subsystem: when an alert rule's callbacks field is written as ${ibex}/<task_tpl_id>, after an alert event fires it pulls up the script of the corresponding task_tpl on the machine matching the current event's TargetIdent and runs it on that machine's categraf. The script receives the labels of the current alert through stdin.
This skill focuses on writing/modifying the task_tpl.script field itself—it does not cover creating alert rules, configuring recipients, or editing notification templates.
1. Scope: First Determine Which Layer the User Is Changing
The Nightingale alert pipeline has four layers, and each goes through a different skill:
| Layer | Entity | Key files | Handled by this skill |
|---|---|---|---|
| Self-healing script task_tpl | task_tpl table |
models/task_tpl.go, alert/sender/ibex.go |
Yes |
| Alert rule | alert_rule table |
models/alert_rule.go |
No (use create-alert-rule) |
| Notification template | notify_tpl table |
models/notify_tpl.go |
No (use generate-message-template) |
| Notification channel | notify_channel table |
models/notify_channel.go |
No (use notify-channel-copilot) |
Judgment criteria: the user's wording contains "script/shell/bash/python/jq/parse/execute/timeout"—this skill; contains "PromQL/threshold/trigger condition"—alert rule; contains "template/body/field rendering"—message template; contains "URL/Webhook/signature"—notification channel.
2. Data Model (What the User Can Fill In, Which Fields Nightingale Actually Uses)
TaskTpl (models/task_tpl.go:17-35)
| Field | Type | Meaning |
|---|---|---|
id |
int64 | Primary key; this is what ${ibex}/<id> in the alert rule callbacks references |
group_id |
int64 | Business group (permission boundary, validated by CanDoIbex) |
title |
string | Template name; at execution time it is concatenated into <title> FH: <hostname> and written as the task title |
script |
string | The main field this skill operates on |
args |
string | Command-line arguments. If the caller does not pass args when the alert fires and executes, the default value here is used |
tags |
string | Space-separated tags, used for template list filtering/classification, does not affect execution |
account |
string | Which user identity to run as on the target machine (e.g. root) |
batch |
int | Number of hosts running concurrently per batch. Self-healing usually only runs on the host that triggered it, so 0 is fine |
tolerance |
int | Allowed failure count within a batch. Leave at 0 for single-host self-healing scenarios |
timeout |
int | Seconds. 0 → defaults to 30; > 5 days → rejected |
pause |
string | Pause schedule between batches (cron style). Basically unused for self-healing |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 733 lines · 168 tokens per session scan E afd7bbc2089b
modify-task-tpl is a skill published in the GitHub repository ccfos/nightingale (13,271 stars, last pushed 2d ago), licensed Apache-2.0. It adds 168 tokens to every session and 7,747 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it E with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-database-10.8
Ensure Monitoring and Alerting is Enabled.
Alerting & Monitoring Testing
Testing monitoring and alerting configurations including threshold validation, alert routing, escalation policies, and false-positive rate monitoring.
grafana-expert
Expert-level Grafana dashboards, visualization, data sources, alerting, and production operations.
monitoring
Skill "monitoring" from chaterm/terminal-skills, covering 监控与告警, 概述, prometheus, 基础查询（promql） and 即时向量.
monitoring-expert
Expert-level monitoring and observability with Prometheus, Grafana, logging, and alerting.
prometheus-expert
Expert-level Prometheus monitoring, metrics collection, PromQL queries, alerting, and production operations.