Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cozystack/ccp/talos-bootstrapnpx skills add cozystack/ccp --skill talos-bootstrapgit clone --depth 1 https://github.com/cozystack/ccpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00177 | $0.10219 |
| Opus 5 | $0.00088 | $0.05110 |
| Sonnet 5 | $0.00035 | $0.02044 |
| Haiku 4.5 | $0.00018 | $0.01022 |
Grade D, and why
talos-bootstrap scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 0600 "$CONFIG_DIR/kubeconfig.yaml" Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- **Kubeconfig merge target** (when `<config-dir>/kubeconfig.yaml` already exists or operator wants merge into `~/.kube/config`). How it starts
The opening of the file, as written. The whole thing — 674 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cozystack:talos-bootstrap
Work in reasoning mode. Use the phrasing cozystack:talos-bootstrap. Announce phase transitions: cozystack:talos-bootstrap Phase N — <name>.
Note on language in this SKILL.md — every operator-facing prompt below is written in English for clarity. At runtime the skill matches the operator's natural language detected from prior conversation messages (or read from
<config-dir>/.state.yamloperator_languagewhen the wizard chain is in progress). Treat the English text as a template for tone, structure, and content. Code identifiers, commands, file paths, and any text destined for GitHub stay canonical regardless of operator language.
Core principles
- Match the operator's natural language. Read from
<config-dir>/.state.yamloperator_language(set bycozystack:wizardPhase 0) or detect from prior messages when invoked directly. Use it in prompts, AskUserQuestion options, summaries, and gates. Code identifiers, commands, file paths, and GitHub-public text stay in their canonical form. - One valid path → just do it. The skill executes
talm init/talm apply/talosctl bootstrap/talosctl kubeconfig/ verification automatically once Phase 5 (boot method) or Phase 4 (maintenance-mode probe) confirmed there's one valid forward direction. Gates remain for (a) multi-option choices (Phase 3 needs-help, Phase 5 boot method per provider, Phase 7 per-node review), (b) destructive operations (talosctl resetof an already-configured node), (c) the consolidated plan presentation. No "I'll wait for you to say done" gates — the skill verifies on its own schedule. - Front-load the interview. Every question the skill might ask in any phase is collected upfront, before
talm initruns: needs-OS-install (Phase 3), per-node boot method (Phase 5, for nodes the probe found unready), per-node install disk choice on multi-disk nodes, VIP for HA, custom installer schematic if not the default. Phases 1 (state) + 2 (workstation prep) + 4 (maintenance probe) are read-only lookups that run before any question fires.intent_hintsfrom wizard Phase 0 pre-fills wherever it can. Phase 7 per-node review is one consolidated screen for all node configs, not one screen per node. Phases 6–12 then execute end-to-end without re-prompting. - Layer-pure operator output. The skill never says "returning control to wizard", "the wizard will dispatch next", or any other orchestration commentary in the operator-facing summary. Whoever invoked the skill (a human running
/cozystack:talos-bootstrapdirectly, or the wizard's dispatch loop) figures out what's next on their own — the wizard reads.state.yamland decides; a human reads the printednext:hint at the bottom of the NOTES. Internal SKILL.md references tocozystack:wizardare fine for documentation, butwizarddoes not appear in any text shown to the operator. - Maintenance mode is the baseline. Talos in maintenance mode is the standard entry point — listening on
:50000awaiting machine-config. The skill drivestalm applydirectly against the maintenance API; no SSH, no OCI dance, no boot-to-talos invocation when nodes are already there. Only when nodes aren't imaged yet does the skill detour through a boot-method picker. - Source of truth for everything Cozystack expects in Talos:
- Tuned image:
ghcr.io/cozystack/cozystack/talos:vX.Y.Z— read the pinned tag from the installer profile in this resolution order:--installer-profile-url=<url>override (rare; for testing).--cozystack-repo=<path>/packages/core/talos/images/talos/profiles/installer.yamloverride.~/git/github.com/cozystack/cozystack/packages/core/talos/images/talos/profiles/installer.yamldefault.- URL fallback
https://raw.githubusercontent.com/cozystack/cozystack/<release>/packages/core/talos/images/talos/profiles/installer.yamlwhen no local clone is present (<release>is the cozystack tag fromstate.cozystack.installer_versionor the latest fromgit ls-remote --tags https://github.com/cozystack/cozystackif not set).
- System extensions: drbd, zfs, openvswitch, plus firmware (amd-ucode / intel-ucode / intel-ice / etc.).
- Kernel modules in machine-config: drbd, zfs, spl, openvswitch, vfio_pci, vfio_iommu_type1.
- LVM filter in
/etc/lvm/lvm.conf:global_filter = [ "r|^/dev/drbd.*|", "r|^/dev/dm-.*|", "r|^/dev/zd.*|" ]. - talm preset:
cozystackchart from~/git/github.com/cozystack/talm/charts/cozystack.
- Tuned image:
- Verify before declaring success. A green Apply is not enough —
kubectl get nodes Ready, talos extensions present, LVM filter present.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 674 lines · 177 tokens per session scan D fe0b9965ee1a
talos-bootstrap is a skill published in the GitHub repository cozystack/ccp (4 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 177 tokens to every session and 10,219 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…