Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fakoli/fakoli-plugins --skill gws-scriptgit clone --depth 1 https://github.com/fakoli/fakoli-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fakoli/fakoli-plugins/gws-script)<a href="https://agentmods.dev/skills/fakoli/fakoli-plugins/gws-script"><img src="https://agentmods.dev/badge/skills/fakoli/fakoli-plugins/gws-script/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fakoli/fakoli-plugins/gws-script"><img src="https://agentmods.dev/badge/skills/fakoli/fakoli-plugins/gws-script.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.00521 |
| Opus 5.5 | $0.00008 | $0.00208 |
| Sonnet 5.5 | $0.00004 | $0.00104 |
| Haiku 4.5 | $0.00002 | $0.00052 |
Grade A, and why
gws-script scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
gws script
Reference: See the
gws-sharedskill for auth, global flags, and security rules.
Deploy and manage Google Apps Script projects using the gws CLI.
Helper Command
+push — Upload local files to an Apps Script project
Replaces ALL files in the target Apps Script project with files from a local directory.
gws script +push --script SCRIPT_ID
gws script +push --script SCRIPT_ID --dir ./src
Supported file types: .gs, .js, .html, appsscript.json
Automatic behavior:
- Skips hidden files and
node_modules - Replaces the entire project content (not a merge)
Raw API Access
You can also use the Apps Script API directly:
# List script projects
gws script projects list
# Get project content
gws script projects getContent --params '{"scriptId": "SCRIPT_ID"}'
# Get project metadata
gws script projects get --params '{"scriptId": "SCRIPT_ID"}'
Examples
Deploy a script from current directory
# Check what files will be uploaded
ls *.gs *.html appsscript.json
# Push to the project
gws script +push --script 1BxTjDmEZcABxhVBmFLRfMXD4eHJB7k_g2r-example
Deploy from a specific directory
gws script +push --script SCRIPT_ID --dir ./apps-script-src
View current project content before pushing
gws script projects getContent --params '{"scriptId": "SCRIPT_ID"}'
Caution
+pushreplaces all files in the project — there is no merge or diff- Always verify the script ID before pushing
- Consider keeping a backup of the current project content:
gws script projects getContent --params '{"scriptId": "SCRIPT_ID"}' > backup.json
Tips
- Keep your Apps Script source files in a dedicated directory (e.g.,
./apps-script/) - Use version control (git) alongside
+pushfor change tracking - The
appsscript.jsonmanifest file controls runtime settings, scopes, and triggers
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 82 lines · 21 tokens per session scan A ec8ee88160a9
gws-script is a skill published in the GitHub repository fakoli/fakoli-plugins (4 stars, last pushed 1mo ago), licensed MIT. It adds 21 tokens to every session and 521 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
infrastructure-planning
Plan and document the required software, infrastructure, and logistics for a Paperclip company — domains, GitHub, Docker Hub, Kubernetes, Slack, Google Workspace, Stripe, shipping providers, and CI/CD pipelines. Use when setting up infrastructure for a new company or auditing what an existing company needs.
istio
Istio service mesh: traffic management, gateways, virtual services, destination rules, mTLS, authorization policies, EnvoyFilters, and observability.
kubernetes
Kubernetes and GKE operations: kubectl, manifests, deployments, services, workload identity, autopilot, config connector, private clusters, and troubleshooting.
auth
Authentication/authorization infra with Keycloak and OAuth2-proxy. Use for identity providers, SSO, OIDC/SAML, realm/client config, user federation, and OAuth2-proxy sidecar or ingress auth on Kubernetes.
terraform
Terraform infrastructure-as-code for provisioning cloud and Kubernetes resources: modules, state and backends, providers, and plan/apply workflows.
helm
Helm chart authoring, templating, and release management for Kubernetes: charts, values, templating functions, repositories, dependencies, and lifecycle operations.