Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-grafanagit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-grafana)<a href="https://agentmods.dev/skills/cosmix/loom/loom-grafana"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-grafana/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmix/loom/loom-grafana"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-grafana.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 136 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.06379 |
| Opus 5 | $0.00009 | $0.03189 |
| Sonnet 5 | $0.00003 | $0.01276 |
| Haiku 4.5 | $0.00002 | $0.00638 |
Grade A, and why
loom-grafana scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 446 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Grafana and the LGTM Stack
Visualization, dashboards, alerting, and exploration. Scope: dashboards/panels, LogQL, TraceQL, data sources, templating, Grafana alerting. PromQL query semantics → loom-prometheus.
Overview
| Component | Role | Query lang |
|---|---|---|
| Loki | Log aggregation; indexes labels only, not content | LogQL |
| Grafana | Visualization, dashboards, unified alerting, Explore | — |
| Tempo | Distributed tracing; columnar Parquet, OTel-native | TraceQL |
| Mimir | Long-term, multi-tenant Prometheus storage (remote_write) |
PromQL |
Collector: Grafana Alloy (OTel Collector distribution). Grafana Agent is EOL (2025-11-01) — migrate.
Dashboard Design
Hierarchy: Overview → Service → Component → Deep Dive. Signals: RED (Rate/Errors/Duration) for services, USE (Utilization/Saturation/Errors) for resources. Variable-driven, 24-column grid, < 15 panels/dashboard.
Panel types
| Panel | Best for |
|---|---|
| Time Series | trends: rates, latency, resource usage (default; replaces removed Graph) |
| Stat | single current value / sparkline |
| Gauge / Bar Gauge | progress toward a limit / Top-N comparison |
| Table | structured rows: service lists, error details |
| Heatmap | distribution over time (latency buckets); renders native histograms |
| Pie | proportions (use sparingly) |
| Logs / Traces | Loki streams / Tempo trace view |
Panel config
- Titles include the unit + dimension ("P95 Latency (s) by Endpoint", not "Latency"); add a description tooltip.
- Units: always set
fieldConfig.defaults.unit(s,bytes,reqps,percentunitfor 0–1 ratios,percentfor 0–100). Wrong unit is the most common panel bug. - Legends:
{{label}}templating; hide for single series; sort by value for Top-N. - Thresholds: green (normal) / yellow (warning) / red (critical); drive Stat/Gauge color and Time Series bands.
- Data links: drill Overview→Service→Component; link to logs/traces/runbooks.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · -41 tokens per session 9dbeb85f26dd
- 10d ago First seen · 446 lines · 58 tokens per session scan A ab0ab7d6a9a2
loom-grafana is a skill published in the GitHub repository cosmix/loom (54 stars, last pushed today), licensed MIT. It adds 17 tokens to every session and 6,379 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
API Discoverability for Agents
Making self-hosted services agent-discoverable — bake in a machine-readable API description (OpenAPI spec or a minimal API.md) when building, and discover-first (spec paths, repo search) before probing when integrating.
Agent Design Principles
A checklist for designing agent personas, skills, and multi-agent pipelines that stay reliable as they grow — grounded in the 12-factor-agents principles.
workers-best-practices
Cloudflare Workers best practices for production applications. Use when writing, reviewing, or configuring Workers.
find-journalists
Build, refine, dedupe, and enrich small fit-checked journalist lists for newsjack campaigns. Uses the newsjack CLI (preferred) or the medialyst MCP for news search and journalist enrichment, and falls back to a best-effort local mode with no verified contacts; the agent owns how returned data is organized.
story-origin-check
Recover the first public timestamp and canonical major coverage for a newsjacking signal, then decide whether newer coverage is the same story, a different story, or a materially new development.
relevance-coarse-filter
Cheap, high-recall first-pass filter that removes obvious junk from a detector candidate pool before expensive story-origin research and PR judgment. Decides keep, monitoronly, or reject — never ranks, writes angles, verifies dates, or decides whether to pitch.