loom-karpenter

loom-karpenter is a skill for Claude Code from cosmix/loom. It costs 18 tokens per session (5,754 once invoked), scanned C, original, MIT.

Karpenter configuration guidance for automatically adding, sizing, consolidating, and removing Kubernetes worker nodes on AWS. Kubernetes is a system for running containers, and Karpenter chooses cloud instances for pods that cannot yet run.

In plain words
What is it for?
Use it to configure NodePools and EC2NodeClasses, manage spot instances, consolidate nodes, right-size clusters, and support different CPU architectures.
Why use it?
It helps match node capacity to actual pending workloads and reduce waste from oversized or poorly selected instances.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Good fit Use it to configure NodePools and EC2NodeClasses, manage spot instances, consolidate nodes, right-size clusters, and support different CPU architectures.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cosmix/loom/loom-karpenter
View source ↗ cosmix/loom
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cosmix/loom --skill loom-karpenter
Clone the repo
git clone --depth 1 https://github.com/cosmix/loom

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for loom-karpenter

README.md
[![agentmods](https://agentmods.dev/badge/skills/cosmix/loom/loom-karpenter.svg)](https://agentmods.dev/skills/cosmix/loom/loom-karpenter)
Your own site
<a href="https://agentmods.dev/skills/cosmix/loom/loom-karpenter"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-karpenter.svg" alt="Measured on agentmods" height="20"></a>
Per session 18 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,754 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00018 $0.05754
Opus 5 $0.00009 $0.02877
Sonnet 5 $0.00004 $0.01151
Haiku 4.5 $0.00002 $0.00575

Measured 4d ago against content hash fdac9a1fd48c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade C, and why

loom-karpenter scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Cloud metadata endpointhighServer-side request forgery

One request to 169.254.169.254 can return temporary IAM credentials.

- **`httpPutResponseHopLimit` defaults to 1 in v1** (was 2). This deliberately prevents non-`hostNetwork` pods from reaching IMDS (169.254.169.254) — the response TTL expires crossing the container netns. Any pod calling
skills/loom-karpenter/SKILL.md · 359 lines

How it starts

The opening of the file, as written. The whole thing — 359 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Karpenter

Overview

Karpenter provisions right-sized nodes directly from cloud-provider APIs based on aggregate pending-pod resource requests — no node groups, sub-minute scale-up, active consolidation to cheaper nodes. vs Cluster Autoscaler: no predefined ASGs, picks from all instance types, bin-packs, first-class spot (on-demand fallback is opt-in, NOT automatic).

Core dependency: accurate pod resources.requests — Karpenter bin-packs against requests (limits are ignored for scheduling). Instance-type flexibility is the engine of bin-packing and consolidation; over-constraining families defeats both and narrows the spot pool.

This skill targets the v1 API (Karpenter 1.0+): NodePool = karpenter.sh/v1, EC2NodeClass = karpenter.k8s.aws/v1. The pre-v1 Provisioner/AWSNodeTemplate and v1beta1 are gone (see Currency).

Examples

1. Basic NodePool (broad, flexible)

apiVersion: karpenter.sh/v1
kind: NodePool
metadata: {name: default}
spec:
  template:
    spec:
      # v1 requires group AND kind alongside name (no default fallback → NotReady).
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: default
      requirements:
        - {key: kubernetes.io/arch, operator: In, values: ["amd64", "arm64"]}
        # Prefer instance-category + generation over a fixed family list (broader
        # spot pool, auto-adopts new generations — the official default).
        - {key: karpenter.k8s.aws/instance-category, operator: In, values: ["c", "m", "r"]}
        - {key: karpenter.k8s.aws/instance-generation, operator: Gt, values: ["2"]}
        # Both types in ONE NodePool = on-demand fallback when spot is exhausted.
        - {key: karpenter.sh/capacity-type, operator: In, values: ["spot", "on-demand"]}
      # expireAfter is a v1 TEMPLATE field and is drift-able (changing it rolls nodes).
      expireAfter: 720h
      taints: [{key: workload-type, value: general, effect: NoSchedule}]
  limits: {cpu: 1000, memory: 1000Gi}   # soft, eventually-consistent, per-NodePool (see Gotchas)
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized   # v1 name; WhenUnderutilized is rejected
    consolidateAfter: 30s
    budgets: [{nodes: "10%", duration: 5m}]
  weight: 10

Read the full file on GitHub · 359 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago Changed · -34 tokens per session fdac9a1fd48c
  2. 8d ago First seen · 359 lines · 52 tokens per session scan C 98b700174547

Subscribe to this mod's changes

loom-karpenter is a skill published in the GitHub repository cosmix/loom (54 stars, last pushed yesterday), licensed MIT. It adds 18 tokens to every session and 5,754 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

wrangler

Run or troubleshoot Wrangler CLI commands and configure Worker projects for local development, deployment, and Cloudflare resource management.

cloudflare/skills · 25 tokens

aws-cloudformation-ecs

Provides AWS CloudFormation patterns for ECS clusters, task definitions, services, container definitions, auto scaling, blue/green deployments, CodeDeploy integration, ALB integration, service discovery, monitoring, logging, template structure, parameters, outputs, and cross-stack references. Use when creating ECS…

giuseppe-trisciuoglio/developer-kit · 101 tokens

configure-log-aggregation

Set up centralized log aggregation with Loki and Promtail (or ELK stack), including log parsing, label extraction, retention policies, and integration with metrics for correlation. Use when consolidating logs from multiple services into a searchable system, replacing local log files with centralized queryable storage…

pjt222/agent-almanac · 86 tokens

deploy-to-kubernetes

Deploy applications to Kubernetes clusters using kubectl manifests for Deployments, Services, ConfigMaps, Secrets, and Ingress resources. Implement health checks, resource limits, rolling updates, and Helm chart packaging for production deployments. Use when deploying new applications to EKS, GKE, AKS, or self-hosted…

pjt222/agent-almanac · 101 tokens

configure-reverse-proxy

Configure reverse proxy patterns across multiple tools including Nginx, Traefik, and ShinyProxy. Covers WebSocket proxying, path-based and host-based routing, SSL termination, and Docker label auto-discovery. Use when routing multiple services behind a single entry point, proxying WebSocket connections (Shiny…

pjt222/agent-almanac · 98 tokens

deploy-shinyproxy

Deploy ShinyProxy for hosting multiple containerized Shiny applications. Covers ShinyProxy Docker deployment, application.yml configuration, Shiny app Docker images, authentication, container backends, usage tracking, and scaling. Use when hosting multiple Shiny apps behind a single entry point, needing per-app…

pjt222/agent-almanac · 90 tokens