Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/emdash-cms/emdash/emdash-clinpx skills add emdash-cms/emdash --skill emdash-cligit clone --depth 1 https://github.com/emdash-cms/emdashWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00056 | $0.01976 |
| Opus 5 | $0.00028 | $0.00988 |
| Sonnet 5 | $0.00011 | $0.00395 |
| Haiku 4.5 | $0.00006 | $0.00198 |
Grade A, and why
emdash-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
EmDash CLI
The EmDash CLI (emdash or ec) manages EmDash CMS instances. Commands fall into two categories:
- Local commands — work directly on a SQLite file, no running server needed:
init,dev,seed,export-seed,auth secret - Remote commands — talk to a running EmDash instance via HTTP:
types,login,logout,whoami,content,schema,media,search,taxonomy,menu
Authentication
Remote commands resolve auth automatically:
--tokenflagEMDASH_TOKENenv var- Stored credentials from
emdash login - Dev bypass (localhost only — no token needed)
For local dev servers, just run the command — auth is handled automatically. For remote instances, run emdash login --url https://my-site.pages.dev first.
Custom Headers & Reverse Proxies
Sites behind Cloudflare Access or other reverse proxies need auth headers on every request. The CLI supports this via --header flags and environment variables.
Service Tokens (Recommended for CI/Automation)
# Single header
npx emdash login --url https://my-site.pages.dev \
--header "CF-Access-Client-Id: xxx.access" \
--header "CF-Access-Client-Secret: yyy"
# Short form
npx emdash login -H "CF-Access-Client-Id: xxx" -H "CF-Access-Client-Secret: yyy"
# Via environment (newline-separated)
export EMDASH_HEADERS="CF-Access-Client-Id: xxx
CF-Access-Client-Secret: yyy"
npx emdash login --url https://my-site.pages.dev
Headers are persisted to ~/.config/emdash/auth.json after login, so subsequent commands inherit them automatically.
Cloudflare Access Browser Flow
If you don't have service tokens and cloudflared is installed, the CLI will automatically:
- Detect when Access blocks the request
- Try to get a cached JWT via
cloudflared access token - Fall back to
cloudflared access loginfor browser-based auth
This works for interactive use but isn't suitable for CI. Use service tokens for automation.
Generic Reverse Proxy Auth
The --header flag works with any auth scheme:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 243 lines · 56 tokens per session scan A c4f496e8614b
emdash-cli is a skill published in the GitHub repository emdash-cms/emdash (12,111 stars, last pushed 3d ago), licensed MIT. It adds 56 tokens to every session and 1,976 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wordpress-plugin-to-emdash
Port a WordPress plugin to EmDash CMS. Use this skill when asked to migrate, convert, or port a WordPress plugin, theme functionality, or custom post type to EmDash. Provides concept mapping and implementation patterns.
building-emdash-site
Build and customize EmDash CMS sites on Astro. Use when creating pages, defining collections, writing seed files, querying content, rendering Portable Text, setting up menus/taxonomies/widgets, configuring deployment, or any task involving an EmDash-powered Astro site. Assumes basic Astro knowledge but provides all…
emdash-cli
Use the EmDash CLI to manage content, schema, media, and more. Use this skill when you need to interact with a running EmDash instance from the command line — creating content, managing collections, uploading media, generating types, or scripting CMS operations.
emdash-github-actions
Sets up GitHub Actions CI/CD workflows for EmDash plugins — TypeScript type-checking, ESLint linting, Vitest testing, npm publishing, and automated releases. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for an EmDash…
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
agent-browser
Browser automation for testing and verification. Use when you need to interact with web UIs, verify visual changes, fill forms, or capture screenshots.