Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/CUHK-AIM-Group/NeuroClawnpx agentmods add skills/cuhk-aim-group/neuroclaw/neurostormWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cuhk-aim-group/neuroclaw/neurostorm)<a href="https://agentmods.dev/skills/cuhk-aim-group/neuroclaw/neurostorm"><img src="https://agentmods.dev/badge/skills/cuhk-aim-group/neuroclaw/neurostorm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cuhk-aim-group/neuroclaw/neurostorm"><img src="https://agentmods.dev/badge/skills/cuhk-aim-group/neuroclaw/neurostorm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 70 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 86 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- low Tool Misuse · line 86 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00255 | $0.03629 |
| Opus 5 | $0.00128 | $0.01814 |
| Sonnet 5 | $0.00051 | $0.00726 |
| Haiku 4.5 | $0.00026 | $0.00363 |
Grade A, and why
neurostorm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 373 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NeuroSTORM Skill
Overview
neurostorm-skill wraps the unified NeuroSTORM fMRI platform (CUHK-AIM-Group), which, as of the 2026-05-08 release, ships 8 model implementations under a single training/fine-tuning entry point. Use this skill for the full lifecycle: data download, preprocessing, pretraining, fine-tuning, and inference.
Supported models (8)
| Model | Input type | Graph? | Backbone |
|---|---|---|---|
neurostorm |
voxel (4D) | No | Mamba-SSM |
swift |
voxel (4D) | No | Swin 4D Transformer |
braingnn |
FC graph (2D) | Yes | GNN |
bnt |
FC matrix (2D) | No | Transformer |
lggnn |
ROI + FC | Yes | Learnable GNN |
combraintf |
FC matrix (2D) | No | Community-aware Transformer |
ibgnn |
FC graph (2D) | Yes | Interpretable GNN |
brainnetcnn |
FC matrix (2D) | No | CNN |
Supported tasks
| ID | Task |
|---|---|
| 1 | Age & Gender Prediction |
| 2 | Phenotype Prediction |
| 3 | Disease Diagnosis |
| 4 | fMRI Retrieval |
| 5 | Task fMRI State Classification |
Supported datasets: HCP1200, ABCD, UKB, Cobre, ADHD200, HCPA, HCPD, UCLA, HCPEP, HCPTASK, GOD, NSD, BOLD5000.
Dual data formats: PT (faster random access, larger disk) and H5 (compact, scales to large cohorts). Choose at preprocessing and at training via --output_format / --data_format.
Installation
Use the upstream requirements.txt + set_env.sh flow (Python 3.11, CUDA 12.8, PyTorch 2.7.1).
# 1. Clone and enter
git clone https://github.com/CUHK-AIM-Group/NeuroSTORM.git
cd NeuroSTORM
# 2. Create and activate env
conda create -n neurostorm python=3.11
conda activate neurostorm
# 3. Auto-detect conda + CUDA paths, set TORCH_CUDA_ARCH_LIST
source ./set_env.sh
# 4. Core dependencies
pip install -r requirements.txt
pip install "setuptools<81" # pytorch-lightning 1.9.4 compat
pip install "transformers<=4.39.3" # mamba-ssm compat
# 5. Graph-based models (BrainGNN / LG-GNN / IBGNN)
pip install torch-geometric
pip install torch-scatter torch-sparse -f https://data.pyg.org/whl/torch-2.7.0+cu128.html
# 6. FC-based models (BNT / BrainNetCNN / Com-BrainTF)
pip install scikit-learn pandas h5py deepdish
# 7. Mamba-SSM (NeuroSTORM only)
bash scripts/install_mamba.sh
# or manually: causal-conv1d v1.5.0.post8, mamba v2.2.2
# both built with TORCH_CUDA_ARCH_LIST matching your GPU (12.0 Blackwell,
# 9.0 H100, 8.9 4090, 8.6 3090, 8.0 A100)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 373 lines · 255 tokens per session scan A dde6566b4173
neurostorm is a skill published in the GitHub repository CUHK-AIM-Group/NeuroClaw (85 stars, last pushed 6d ago), licensed MIT. It adds 255 tokens to every session and 3,629 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
arboreto
Infer gene regulatory networks (GRNs) from gene expression data using scalable algorithms (GRNBoost2, GENIE3). Use when analyzing transcriptomics data (bulk RNA-seq, single-cell RNA-seq) to identify transcription factor-target gene relationships and regulatory interactions. Supports distributed computation for…
pyhealth
Build clinical/healthcare deep-learning pipelines with PyHealth — loading EHR/signal/imaging datasets (MIMIC-III/IV, eICU, OMOP, SleepEDF, ChestXray14, EHRShot), defining tasks (mortality, readmission, length-of-stay, drug recommendation, sleep staging, ICD coding, EEG events), instantiating models (Transformer…
torchdrug
Build and troubleshoot TorchDrug 0.2.1 workflows for molecular graphs, property prediction, self-supervised pretraining, molecule generation, retrosynthesis, protein representation learning, and knowledge graph reasoning. Use when code imports torchdrug or needs its datasets, models, tasks, or Engine.
deepspot-m
Generate transcriptome-wide virtual spatial transcriptomics from H&E histology with DeepSpot-M. Use when you need spatial gene expression in log1p-CPM for 224x224 tiles at about 20x, want to query protein-coding genes by symbol instead of a fixed panel, or want to run prediction across a whole slide after tiling with…
nemo-mbridge-perf-expert-parallel-overlap
Validate and use MoE expert-parallel communication overlap in Megatron-Bridge, including overlapmoeexpertparallelcomm, delaywgradcompute, and flex dispatcher backends such as DeepEP and HybridEP.
pick-a-pii-model
Select an on-device OpenMed PII model from the committed registry by language, runtime format, and size budget, then require recall validation before deployment. Use when an agent must choose a local PII detector for CPU, Apple Silicon, or a mobile export without relying on live model discovery.