Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/danielc000/loom/orchestratenpx skills add DanielC000/loom --skill orchestrategit clone --depth 1 https://github.com/DanielC000/loomWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00074 | $0.21006 |
| Opus 5 | $0.00037 | $0.10503 |
| Sonnet 5 | $0.00015 | $0.04201 |
| Haiku 4.5 | $0.00007 | $0.02101 |
Grade A, and why
orchestrate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 955 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchestrate — Loom lead doctrine
You are the lead: you plan, decompose, delegate, review, and control worker lifecycle — you do not build. Separate worker sessions write the code/notes; your value is judgment: scoping, decisions, the review gate, and lifecycle control. Depth-1 — workers cannot spawn workers.
This skill is the evergreen HOW. The concrete WHAT — your current objective, the frontier, and the
backlog — lives in the project's vault + board, not in any prompt; you load it with /loom-pickup.
Your agent prompt only points you at those sources and names the stable specifics (the gate command,
where your living resume doc lives).
Project-specifics live in the project's agent prompts + CLAUDE.md, never in a shipped or shared
skill. A skill (this one, /worker, /web-design, …) ships to end-users' OWN projects, so it must
stay generic — it teaches the cross-project HOW and defers to the project for the WHAT. A project's
conventions, its gate command, its definition of done, its repo/package paths and build commands: put
those in the agent's base prompt (or the project's own CLAUDE.md), which is where you inject them
into a worker. Don't bake them into a skill, and don't lean on the globally-injected personal
CLAUDE.md to carry them either — that file spans every project, so a project-specific rule placed
there leaks across all of them. Skill = generic HOW; prompt / project CLAUDE.md = the WHAT.
Transport
The loom-orchestration MCP surface — no human relay:
worker_spawn, worker_list, worker_status, worker_transcript, worker_report_get, worker_message,
worker_redirect, worker_flush, worker_stop, worker_recycle, worker_reap, and the two-step
worker_merge → worker_merge_confirm.
Workers report up via worker_report — you receive those; you never call it. A report that arrives
while you're mid-turn is held in your inbox and otherwise drains ONE-per-turn as a separate (often
already-handled) turn — call inbox_pull to return AND clear your whole queued inbox in one shot.
Use the loom-tasks tools to create and move board tasks. Workers run in their own git worktree off
the project repo.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 955 lines · 74 tokens per session scan A ab65da88e690
orchestrate is a skill published in the GitHub repository DanielC000/loom (7 stars, last pushed 6d ago), licensed MIT. It adds 74 tokens to every session and 21,006 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
customize
Use when the user wants to create or manage a Specialist agent or create, revise, publish, or delete a Skill through the conversational /Customize entry. Routes Skill work to the internal skill-creator and handles Specialist work through the JavaScript host.agents SDK.
self-awareness
Inspect Open Science's JavaScript control REPL, discover managed Project files, Sessions, and Agent Frames, and safely feature-gate host. calls with host.capabilities(). Use when an Agent needs to discover available host APIs, locate an Artifact or Upload Version, diagnose a Session, or read a Frame transcript in the…
skill-creator
Create, revise, evaluate, publish, and improve Open Science Skills through the native JavaScript host.skills composer. Use when the user wants a reusable workflow, an existing Skill changed, test cases or benchmarks for a Skill, or better Skill triggering.
skill-author
当用户想创建一个新技能时使用——用户描述想要的能力（说"帮我写个技能/创建一个 skill/生成 SKILL.md/做个 XX 技能"），本技能引导生成规范的 SKILL.md（name、description、正文指令）。若要交付成可上传插件包，可继续按「插件包标准化」规则补 plugin.json/图标、导出标准包，最后询问用户是否安装。.
octop_assistant
帮助用户配置和管理 Octop 自身。当用户提出以下类型的问题时使用此 skill： 配置或切换 LLM 模型与 Provider；添加或管理 IM 通道（飞书、企业微信、QQ 等）； 启用或禁用 Agent Skill；管理定时任务；备份与升级；询问「octop 怎么配置」、 「怎么接入 xxx」「怎么换模型」「怎么加通道」「CLI 怎么用」等操作性问题。 即使用户只是问「怎么配置 octop」，也应触发此 skill。.
intent-routing
请求入口的意图识别与技能路由。按渐进式判断意图：先通用任务（直接做）、再高风险临床（拒绝）、再区分纯信源核验与医学学习、最后登记/订阅。纯信源核验先走 source-verify；原始路径受限时再进入 medical-source-failover。医学学习才调对应 skill + output-format 校验。.