Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/elizaos/eliza/coding-agentnpx skills add elizaOS/eliza --skill coding-agentgit clone --depth 1 https://github.com/elizaOS/elizaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00074 | $0.02679 |
| Opus 5 | $0.00037 | $0.01340 |
| Sonnet 5 | $0.00015 | $0.00536 |
| Haiku 4.5 | $0.00007 | $0.00268 |
Grade B, and why
coding-agent scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
**Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml) Copies of this mod
8 near-identical copies found in the catalogue:
- coding-agent — 88% identical, 98 lines differ
- coding-agent — 88% identical, 98 lines differ
- coding-agent — 86% identical, 46 lines differ
- coding-agent — 86% identical, 46 lines differ
- coding-agent — 86% identical, 46 lines differ
- coding-agent — 86% identical, 46 lines differ
- coding-agent — 86% identical, 46 lines differ
- coding-agent — 84% identical, 49 lines differ
How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Coding Agent (bash-first)
Availability
This skill requires the direct download build of Eliza. It is disabled in store-distributed builds (Mac App Store, Microsoft Store, Flathub) because those builds run inside an OS sandbox that forbids forking arbitrary user-installed binaries (Codex, Claude Code, OpenCode, Pi).
When the runtime detects a store build (ELIZA_BUILD_VARIANT=store), the agent-orchestrator plugin registers a single blocked TASKS action that returns a clear blocked-message and does not attempt any spawn. To enable coding agents, install the direct download from https://eliza.so/download.
The single source of truth for this gate is isLocalCodeExecutionAllowed() in @elizaos/core (packages/core/src/sandbox-policy.ts), which both the orchestrator and any future local-execution action consult.
Usage
Use bash (with optional background mode) for all coding agent work. Simple and effective.
⚠️ PTY Mode Required!
Coding agents (Codex, Claude Code, Pi) are interactive terminal applications that need a pseudo-terminal (PTY) to work correctly. Without PTY, you'll get broken output, missing colors, or the agent may hang.
Always use pty:true when running coding agents:
# ✅ Correct - with PTY
bash pty:true command:"codex exec 'Your prompt'"
# ❌ Wrong - no PTY, agent may break
bash command:"codex exec 'Your prompt'"
Bash Tool Parameters
| Parameter | Type | Description |
|---|---|---|
command |
string | The shell command to run |
pty |
boolean | Use for coding agents! Allocates a pseudo-terminal for interactive CLIs |
workdir |
string | Working directory (agent sees only this folder's context) |
background |
boolean | Run in background, returns sessionId for monitoring |
timeout |
number | Timeout in seconds (kills process on expiry) |
elevated |
boolean | Run on host instead of sandbox (if allowed) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 295 lines · 74 tokens per session scan B a95137ecfa0a
coding-agent is a skill published in the GitHub repository elizaOS/eliza (19,210 stars, last pushed yesterday), licensed MIT. It adds 74 tokens to every session and 2,679 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gh-issues
Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5]…
canvas
Display HTML content on connected OpenClaw nodes (Mac app, iOS, Android).
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
gog
Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
himalaya
CLI to manage emails via IMAP/SMTP. Use himalaya to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
node-connect
Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps. Use when QR/setup code/manual connect fails, local Wi-Fi works but VPS/tailnet does not, or errors mention pairing required, unauthorized, bootstrap token invalid or expired, gateway.bind, gateway.remote.url, Tailscale…