Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cynthiajones34/GBrain --skill schema-unifygit clone --depth 1 https://github.com/cynthiajones34/GBrainWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cynthiajones34/gbrain/schema-unify)<a href="https://agentmods.dev/skills/cynthiajones34/gbrain/schema-unify"><img src="https://agentmods.dev/badge/skills/cynthiajones34/gbrain/schema-unify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cynthiajones34/gbrain/schema-unify"><img src="https://agentmods.dev/badge/skills/cynthiajones34/gbrain/schema-unify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.02803 |
| Opus 5 | $0.00049 | $0.01401 |
| Sonnet 5 | $0.00020 | $0.00561 |
| Haiku 4.5 | $0.00010 | $0.00280 |
Grade A, and why
schema-unify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to schema-unify — 42 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Schema Unification (gbrain-base → gbrain-base-v2)
v0.41.22 ships gbrain-base-v2 — a 15-type DRY/MECE taxonomy (14 canonical + note catch-all) — as the install default for new brains. Existing brains on gbrain-base can opt in via the pack_upgrade_available onboard finding + the unify-types PROTECTED Minion handler.
This skill is the playbook for that migration.
brain_first: exempt
This skill is ABOUT the brain's shape — it can't depend on the brain it's reshaping. No gbrain search lookup first; jump straight to onboard.
When this skill fires
- Agent runs
gbrain onboard --checkand seespack_upgrade_availableortype_proliferationwarnings - User asks "what is the canonical taxonomy / how do I clean up my page types / migrate to v2"
- A
dangling_aliasesfinding surfaces (post-unify GC) - An agent ingesting from a custom pack wants to consult the v2 taxonomy as a reference
Mental model (one paragraph)
A production gbrain brain accreted 94 distinct pages.type values over years of ingestion: tweet / tweet-thread / tweet-bundle / tweet-single / media/x-tweet/bundle / tweet-stub all coexisting; 5.5K concept-redirect pages; atom-partner-link pages that should be links; civic / framework / insight / memo / anecdote one-offs. The cure: collapse to 15 canonical types (person, company, media, tweet, social-digest, analysis, atom, concept, source, deal, email, slack, writing, project, note) with subtypes/format/origin pushed to frontmatter, alias-rows for redirects, real link-rows for edge-shaped pages, and a catch-all that bins long-tail unknowns to note with frontmatter.legacy_type = <original> for rollback.
Workflow
Phase 1: Discovery
Confirm the brain is actually on gbrain-base (not already on v2).
gbrain schema active --json | jq -r '.identity'
Expected: [email protected]+<sha>. If you see gbrain-base-v2@..., the brain is already on v2 — skip the migration.
Then run onboard to see what would change:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 256 lines · 99 tokens per session scan A e1d50a54a6ff
schema-unify is a skill published in the GitHub repository cynthiajones34/GBrain (0 stars, last pushed 1mo ago), licensed MIT. It adds 99 tokens to every session and 2,803 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. It is 86% identical to schema-unify, differing in 42 lines, and is treated as a copy.
Other skills, from other repositories
omnigraph
Operate OmniGraph graphs and deployments. Use for .pg schemas, .gq queries, OmniGraph CLI commands, file:///s3:///az:// graph URIs, cluster.yaml, operator config, bearer-authenticated servers, graph-backed knowledge or memory, Blob values, embeddings, branches, commits, and change feeds. Apply especially before schema…
hunt-sqli
Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection…
hunt-nosqli
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
hunt-supabase
Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organizationid check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-tenant enumeration…
firebase-supabase-attack
Exploit Firebase/Supabase for data via JS config leak probe.
hermes-mnemosyne
Mnemosyne is Hermes' primary local-first memory engine — SQLite with vector + FTS5 hybrid search, 19+ tools, auto-consolidation, and a standalone CLI. It's a pip-installed plugin (not a built-in toolset) discovered via $HERMESHOME/plugins/mnemosyne/.