Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fmind/dot --skill smokegit clone --depth 1 https://github.com/fmind/dotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fmind/dot/smoke)<a href="https://agentmods.dev/skills/fmind/dot/smoke"><img src="https://agentmods.dev/badge/skills/fmind/dot/smoke/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fmind/dot/smoke"><img src="https://agentmods.dev/badge/skills/fmind/dot/smoke.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.01091 |
| Opus 5.5 | $0.00007 | $0.00436 |
| Sonnet 5.5 | $0.00003 | $0.00218 |
| Haiku 4.5 | $0.00002 | $0.00109 |
Grade A, and why
smoke scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Smoke
Prove that everything a repository exposes still runs: each task, each CLI command, and each documented example, with a matrix the user can trust. Warnings count as failures. quality-assurance owns risk-based campaigns over user journeys; repository-review owns code findings. Fix defects only when the request includes fixing them.
Workflow
-
Baseline and isolation: record
git status --short. Tasks that format, lock, or generate files mutate the tree; with unrelated work present, run them in a snapshot per git-worktree and report their diff instead of leaving it behind. -
Discover: list every entry point and read each command before running it; never classify by name alone.
mise tasks --json --hidden | jq -r '.[] | select(.global | not) | [.name, ((.run // []) | join(" && "))] | @tsv' MISE_TASK_QUIET=false mise run -n <task> # print the resolved command; quiet settings hide it jq -r '.scripts // {} | keys[]' package.json just --summary; make -pRrq : 2>/dev/null | grep -E '^[a-zA-Z0-9_.-]+:' | cut -d: -f1 | sort -uAdd CLI entry points from
[project.scripts],binfields, andscripts/, plus the commands quoted inREADME.mdand CI workflows. -
Classify: safe (check, lint, test, local build, docs build), mutating (format, fix, lock, generate: snapshot only), service (serve, dev, watch: start under a timeout, probe health, stop it), and external (deploy, release, publish, push, upgrade, login, prune, paid or networked writes). Run an external task only with explicit authority and its
--dry-runwhen it has one; otherwise list it as skipped with the reason. -
Run tasks: start with the repository's aggregate gate (
mise run all,check,test), then each remaining task individually so failures stay attributable. Close stdin, bound time, keep logs, and force tasks whose cached outputs would skip them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed 6406a9df1ce6
- 11d ago First seen · 52 lines · 17 tokens per session scan A b14d4cdfb710
smoke is a skill published in the GitHub repository fmind/dot (11 stars, last pushed 2d ago), licensed MIT. It adds 17 tokens to every session and 1,091 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.
Other skills, from other repositories
mise
Configure pinned mise tools and canonical install, format, check, test, build, and watch tasks shared by hooks and CI.
agent-evaluation
Evaluate stochastic LLM/RAG/model/retrieval/tool agents in trials. Compare baseline/candidate on development/sealed holdouts with calibrated deterministic/model/trace graders; measure reliability, variance, leakage, safety, and cost.
quality-assurance
Design and execute risk-based test campaigns and exercise risky feature journeys; identify what remains unproved across unit, integration, E2E, browser, accessibility, performance, resilience, and manual tests. Not a diff review.
test-driven-development
Implement an isolated bug fix or behavior change with an honest red-green-refactor cycle. Use when a regression test should fail before the correction, or when tested logic, refactors, or seams must prove correctness.
dotfiles-bootstrap
Bootstrap a workstation with the dotfiles framework. Takes a GitHub user / owner+repo / explicit clone URL and runs dot init (which shells out to chezmoi) with the right safety prompts. Honors the active agent profile (ask / plan / apply / audit) so it defaults to dry-run in safer modes and full apply in apply.
vibe
Delegate a coding task to a cheap AI model (Mistral Vibe by default, but any provider Vibe knows about — DeepSeek, Gemini Flash, etc.) and supervise the result via git diff. Claude orchestrates, the cheap model codes. Claude consumes 500-1500 tokens per delegation regardless of how many file reads the delegate does…