demo-3-repo-pulse

demo-3-repo-pulse is a skill for Claude Code, Codex from decodingai-magazine/building-a-coding-agent-from-scratch-course. It costs 52 tokens per session (867 once invoked), scanned A, original, Apache-2.0.

A skill that collects one year's weekly activity from a GitHub repository and turns it into a single HTML dashboard. GitHub is a service for hosting code, and the dashboard includes summary figures and charts made without a chart library.

In plain words
What is it for?
Reviewing a repository's recent activity, comparing weekly commits, seeing top contributors, and opening the resulting dashboard in a browser.
Why use it?
It turns raw repository activity into a page that is easier to inspect, including commit patterns and leading contributors. The input specifies a default repository but allows another owner and repository to be used.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is uv run --with requests python .decode/outputs/pulse.py.

Good fit Reviewing a repository's recent activity, comparing weekly commits, seeing top contributors, and opening the resulting dashboard in a browser.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/decodingai-magazine/building-a-coding-agent-from-scratch-course
agentmods
npx agentmods add skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for demo-3-repo-pulse

README.md
[![agentmods](https://agentmods.dev/badge/skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse/github.svg)](https://agentmods.dev/skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse)
Your own site
<a href="https://agentmods.dev/skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse"><img src="https://agentmods.dev/badge/skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for demo-3-repo-pulse

Your own site · 80×15
<a href="https://agentmods.dev/skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse"><img src="https://agentmods.dev/badge/skills/decodingai-magazine/building-a-coding-agent-from-scratch-course/demo-3-repo-pulse.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 867 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Data Exfiltration · line 18
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
  • medium Data Exfiltration · line 36
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
  • medium Data Exfiltration · line 37
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
  • medium Data Exfiltration · line 40
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00052 $0.00867
Opus 5 $0.00026 $0.00434
Sonnet 5 $0.00010 $0.00173
Haiku 4.5 $0.00005 $0.00087

Measured 12d ago against content hash 82230d3419ee, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

demo-3-repo-pulse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.decode/skills/demo-3-repo-pulse/SKILL.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Build a repo pulse dashboard from live data: probe the GitHub API, pull a repository's last 52 weeks of activity, analyse it, and render everything into one self-contained .decode/outputs/dashboard.html the human can open in a browser. All files this demo produces live under .decode/outputs/ (unless the human named a different path).

Default target repository: pydantic/pydantic-ai. If the human named a different owner/repo, use that instead.

1. Probe the data source

Use web_fetch to look at the live API and learn the exact field names before writing any code:

  • https://api.github.com/repos/pydantic/pydantic-ai — note stargazers_count, forks_count, open_issues_count, description.

That one probe is enough — do not fetch the big endpoints with web_fetch; the analysis script will pull those.

2. Write the analysis script

Write .decode/outputs/pulse.py and run it with the one dependency brought in just for the run (do NOT add project dependencies):

uv run --with requests python .decode/outputs/pulse.py

The script must:

  1. GET these three endpoints (plain requests, no auth token needed):
    • https://api.github.com/repos/{owner}/{repo} — the headline stats.
    • https://api.github.com/repos/{owner}/{repo}/stats/commit_activity — the last 52 weeks of commit counts, one entry per week (total commits + a Unix week timestamp). The whole year arrives in this ONE request — never page through /commits for it.
    • https://api.github.com/repos/{owner}/{repo}/contributors?per_page=10 — top contributors with their commit counts.
  2. The stats endpoint answers 202 while GitHub computes the data: retry a few times with a short sleep until it answers 200 with the 52-entry list.
  3. Aggregate: commits per week across the 52 weeks (label each week with the ISO date of its week timestamp), the busiest week of the year, and the top-10 contributor leaderboard.
  4. If the API answers 403 (rate limit), say so plainly; if GITHUB_TOKEN is set in the environment, send it as a Bearer header.

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 72 lines · 52 tokens per session scan A 82230d3419ee

Subscribe to this mod's changes

demo-3-repo-pulse is a skill published in the GitHub repository decodingai-magazine/building-a-coding-agent-from-scratch-course (383 stars, last pushed 2d ago), licensed Apache-2.0. It adds 52 tokens to every session and 867 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.