Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add chipi/agentic-ai-homelab --skill ci-step-localgit clone --depth 1 https://github.com/chipi/agentic-ai-homelabWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chipi/agentic-ai-homelab/ci-step-local)<a href="https://agentmods.dev/skills/chipi/agentic-ai-homelab/ci-step-local"><img src="https://agentmods.dev/badge/skills/chipi/agentic-ai-homelab/ci-step-local/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chipi/agentic-ai-homelab/ci-step-local"><img src="https://agentmods.dev/badge/skills/chipi/agentic-ai-homelab/ci-step-local.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00142 | $0.01019 |
| Opus 5.5 | $0.00057 | $0.00408 |
| Sonnet 5.5 | $0.00028 | $0.00204 |
| Haiku 4.5 | $0.00014 | $0.00102 |
Grade A, and why
ci-step-local scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ci-step-local
A workflow change used to be tested by pushing it and waiting for a real run. Two changes on 2026-10-17 were proven locally instead, by hand:
- SSH host-key pinning across 23 workflows: the composite action's script was extracted and run against prod with the right key, a wrong key and a garbage key.
- A systemd timer:
systemd-analyze verifyon the box.
The hand-rolled versions kept hitting zsh word-splitting ("File name too long",
zsh: ==== not found) and needed bash -c wrappers. This makes it one command, under bash. For
a one-off remote command (not a step), use host-run.
Run a step
R=~/.claude/skills/ci-step-local/scripts/run_step.py # needs PyYAML: pyenv python3, not /usr/bin/python3
python3 $R .github/actions/prod-ssh-key/action.yml --step 0 \
--sub 'inputs.ssh_private_key=dummy-pem' --sub 'inputs.identity_env_name=SSH_PROD_IDENTITY' \
--sub "inputs.pinned_host_key=ssh-ed25519 AAAA…" --case right-key --expect-exit 0
python3 $R .github/actions/prod-ssh-key/action.yml --step 0 … \
--sub 'inputs.pinned_host_key=not-a-key' --case garbage --expect-exit 1
python3 $R .github/workflows/deploy-config.yml --job deploy --step "Stage + deploy config for the surface" --env DRY_RUN=true …
--step: the step'sid,name, or index among all steps.- Every
${{ … }}in the script or the step'senvmust be given with--sub. An unresolved one refuses (exit 4) instead of running with an empty string, which is how a guard gets proven by accident. - The step runs in your working directory, with your PATH and network: a step that ssh's to prod reaches prod. Run only steps that are read-only or DRY_RUN there, unless the operator said go.
- Always pair a passing case with a case that must fail.
Check systemd units on their host
~/.claude/skills/ci-step-local/scripts/verify_units.sh -i ~/.ssh/podcast_prod_operator deploy@prod-podcast \
infra/systemd/prod-ops-health.service infra/systemd/prod-ops-health.timer
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago First seen · 67 lines · 142 tokens per session scan A cafdb0d300e5
ci-step-local is a skill published in the GitHub repository chipi/agentic-ai-homelab (3 stars, last pushed today), licensed MIT. It adds 142 tokens to every session and 1,019 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
Verification & Quality Assurance
Comprehensive truth scoring, code quality verification, and automatic rollback system with 0.95 accuracy threshold for ensuring high-quality agent outputs and codebase reliability.
github-actions
Use when authoring or fixing GitHub Actions CI/CD — workflows under .github/workflows, triggers, job matrix, caching, token permissions, OIDC cloud deploys, environment gates, reusable workflows. NOT the Dockerfile or image build strategy (that is docker), NOT the branching model (that is git-workflow), NOT release…
e2e-automation-project
Maintain a dedicated automation test project per repository - separate from the product's unit tests - with API, worker, and UI suites written scenario-first.
chaos-experiment
Design and document chaos engineering experiments. Guide steady state baseline, hypothesis formation, failure injection plans, and results analysis. Use when you say "design a chaos experiment", "plan a game day", "failure injection", "test resilience", or "chaos engineering". Do NOT use for security threat analysis…
pr-quality-qa
Judge a local diff on test coverage, error handling, and whether the tests would fail if the code regressed, and return a PASS/WARN/CRITICALFAIL verdict. Use when you say qa review my changes, run the qa gate, or are these tests good enough. Do NOT use to run all six axes (use pr-quality-all), and do NOT use to write…
maas-nightly-qe-impact
Assess whether a Models-as-a-Service autofix change requires follow-up in opendatahub-tests or ods-ci nightly QE pipelines. Runs as a Jira autofix postreview extension for the Model as a Service component. Appends a Nightly QE Impact section to the PR description and writes informational findings. Use when autofix…