Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/cynthiajones34/GBrainnpx agentmods add skills/cynthiajones34/gbrain/skillpack-harvestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cynthiajones34/gbrain/skillpack-harvest)<a href="https://agentmods.dev/skills/cynthiajones34/gbrain/skillpack-harvest"><img src="https://agentmods.dev/badge/skills/cynthiajones34/gbrain/skillpack-harvest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cynthiajones34/gbrain/skillpack-harvest"><img src="https://agentmods.dev/badge/skills/cynthiajones34/gbrain/skillpack-harvest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.02664 |
| Opus 5 | $0.00039 | $0.01332 |
| Sonnet 5 | $0.00016 | $0.00533 |
| Haiku 4.5 | $0.00008 | $0.00266 |
Grade C, and why
skillpack-harvest scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
retains its skill. Don't `rm -rf` the source after harvesting. This is a copy
91% identical to skillpack-harvest — 15 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 271 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skillpack-harvest — Editorial workflow for lifting host skills into gbrain
Convention: see _brain-filing-rules.md for file placement rules. This skill writes into gbrain's own tree, not the brain repo's notes.
This skill is the inverse of gbrain skillpack scaffold. Scaffold ships
skills downstream (gbrain → host). Harvest lifts proven patterns
upstream (host → gbrain) so they become references every other client
can scaffold.
Contract
A harvest is "properly done" when:
- The host skill is mature (used in production, recent routing-eval cases pass).
- The editorial genericization in Phase 3 has scrubbed every fork-specific reference (names, real entities, internal channels).
gbrain skillpack harvest --dry-runpreviewed the file set.- The real
gbrain skillpack harvest <slug> --from <host>succeeded withstatus: harvested(no privacy-lint hits). bun test test/skills-conformance.test.tspasses on the newskills/<slug>/SKILL.md.- The user has reviewed the diff in gbrain and explicitly approved the commit.
If any of these is incomplete, the skill is NOT yet harvested — the files may sit in gbrain's working tree, but they're not landed.
Output Format
This skill produces three artifacts in gbrain's working tree:
skills/<harvested-slug>/SKILL.md(and any sibling files likerouting-eval.jsonl)- Paired source files at their mirror paths (e.g.
src/commands/<slug>.ts) when the host SKILL.md declared them in frontmattersources: - An updated
openclaw.plugin.jsonwith the new slug added toskills:(sorted)
The session output to the user is a one-line success summary plus
a list of files written. JSON mode (--json) returns the full
HarvestResult shape for machine consumption.
Anti-Patterns
- Skipping the dry-run. Always preview first. Files land in
gbrain's working tree; cleanup is a
git checkoutaway, but you shouldn't need to. - Trusting the linter alone. The default regex set catches the common cases. It doesn't catch every proper noun. Phase 3 (the editorial pass) is the primary defense.
- Harvesting
--no-lintwithout justification. The lint exists for a reason. If you bypass it, document why in the commit. - Harvesting a skill that's still in flux. Wait until the host version stabilizes. Otherwise you'll harvest, then re-harvest, then re-harvest, and that churns gbrain's bundle for no benefit.
- Moving files instead of copying. Harvest is a copy. The host
retains its skill. Don't
rm -rfthe source after harvesting. - Harvesting batch (multiple skills at once). Not supported, and for good reason — the editorial review per skill is real work.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 271 lines · 78 tokens per session scan C 3c4c591b33f0
skillpack-harvest is a skill published in the GitHub repository cynthiajones34/GBrain (0 stars, last pushed 1mo ago), licensed MIT. It adds 78 tokens to every session and 2,664 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). It is 91% identical to skillpack-harvest, differing in 15 lines, and is treated as a copy.
Other skills, from other repositories
memory-proactive
Proactive layered recall and generic domain-aware routing.
memory-archivist
A set of scripts for archiving conversations, syncing them to a knowledge graph, updating summaries, and managing stored memories over time. A knowledge graph is a linked collection of information and relationships.
memory-starter-kit
Historical starter note for the memory sidecar stack.
mind
Local project memory with recall, provenance, policy, and dreams.
personal-knowledge-graph
Use when maintaining a LoomKG/Obsidian knowledge graph.
hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024)…