Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cherridsaid/phases-agents/hello-pythonnpx skills add Cherridsaid/phases-agents --skill hello-pythongit clone --depth 1 https://github.com/Cherridsaid/phases-agentsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00014 | $0.00419 |
| Opus 5 | $0.00007 | $0.00210 |
| Sonnet 5 | $0.00003 | $0.00084 |
| Haiku 4.5 | $0.00001 | $0.00042 |
Grade A, and why
hello-python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
hello-python
Skill minimal complet : copiez ce dossier pour démarrer le vôtre.
Loi centrale
Ne conclure que sur un fichier réellement lu. Aucune supposition.
Ce que ce skill fait
Inventorie les fichiers Python du projet et signale les modules sans test associé.
Ce que ce skill ne fait pas
Il n'exécute aucun code, n'installe rien et ne modifie aucun fichier.
Conditions d'activation
Le profil du projet contient le fait has_python.
Conditions d'exclusion
Aucun fichier .py lisible dans la cible.
Capacites necessaires
filesystem_read est obligatoire. filesystem_search accélère l'inventaire.
Interdictions
Ne jamais ouvrir une URL, lancer un interpréteur ou écrire dans la cible.
Methode d'audit
- Lister les fichiers
.py. - Repérer les fichiers
test_*.py. - Associer chaque module à son test.
- Émettre un finding par module non couvert.
Contrat de preuve
Chaque finding cite un chemin relatif existant. Sans chemin lu, le finding est invalide.
Format de sortie
Un tableau de findings conformes à core:FINDING_SCHEMA.json.
Conditions de blocage
Cible illisible ou profil bloqué : rendre BLOCKED, ne rien deviner.
Limites connues
L'association module/test est nominale : un test placé ailleurs n'est pas vu.
Exemples d'entree
Un projet contenant app.py, utils.py et tests/test_app.py.
Exemple de sortie attendue
Un finding EX-001 : utils.py n'a pas de test associé, sévérité P3_LOW, preuve = chemin du module.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 71 lines · 14 tokens per session scan A 0e0966b0227f
hello-python is a skill published in the GitHub repository Cherridsaid/phases-agents (0 stars, last pushed 5d ago), licensed Apache-2.0. It adds 14 tokens to every session and 419 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
binding-enforcement
Claude Code hook configuration that binds Phionyx self-governance to lifecycle events. Loaded when the assistant is editing .claude/settings.json, writing a new hook script under tools/claudecodemcp/, or asked about hook coverage / strict mode / why a hook fired.
mcp-self-governance
Phionyx two-layer MCP architecture rules (pipeline + server). Loaded on demand when the assistant is about to call phionyxresponsegate, phionyxverifyclaim, phionyxcausaltrace, phionyxverifypaths, phionyxcheckpoint, phionyxsessionreport, or any mcpphionyx- tool. Codifies ADR-0006 (two-layer MCP, shared traceid) and the…
state-grounding
How to ground state-fact assertions about external systems (repo visibility, deployment, PyPI, URL liveness) with authoritative checks in the same turn. Loaded when the assistant is about to write or commit a line that claims X is live / X is public / X is deployed / X has version V / branch X has commit Y. Codified…
bump-dependency
Bumps a Python package dependency across Home Assistant Core integrations, regenerates core requirement files, runs verification tests and prek lint, and prepares a pull request with proper release/compare links.
schema-exploration
Lists tables, describes columns and data types, identifies foreign key relationships, and maps entity relationships in a database. Use when the user asks about database schema, table structure, column types, what tables exist, ERD, foreign keys, or how entities relate.
mem0-vercel-ai-sdk
Mem0 provider for Vercel AI SDK (@mem0/vercel-ai-provider). TRIGGER when: user mentions "vercel ai sdk", "@mem0/vercel-ai-provider", "createMem0", "retrieveMemories", "addMemories", "getMemories", "searchMemories", "mem0 vercel", "AI SDK provider", "AI SDK memory", or is using generateText/streamText with mem0. Also…