Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add FortiumPartners/ensemble --skill act-local-cigit clone --depth 1 https://github.com/FortiumPartners/ensembleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fortiumpartners/ensemble/act-local-ci)<a href="https://agentmods.dev/skills/fortiumpartners/ensemble/act-local-ci"><img src="https://agentmods.dev/badge/skills/fortiumpartners/ensemble/act-local-ci/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fortiumpartners/ensemble/act-local-ci"><img src="https://agentmods.dev/badge/skills/fortiumpartners/ensemble/act-local-ci.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00897 |
| Opus 5 | $0.00000 | $0.00449 |
| Sonnet 5 | $0.00000 | $0.00179 |
| Haiku 4.5 | $0.00000 | $0.00090 |
Grade D, and why
act-local-ci scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Act Local CI Skill
Quick Reference - Test GitHub Actions workflows locally using nektos/act
Mission
Run GitHub Actions workflows locally before pushing to validate CI/CD pipelines, catch errors early, and reduce iteration time. Uses nektos/act to simulate GitHub Actions runner environment.
Core Capabilities
- Local Workflow Execution: Run
.github/workflows/*.ymlfiles locally - Job Selection: Execute specific jobs or entire workflows
- Event Simulation: Trigger with push, pull_request, workflow_dispatch events
- Secret Injection: Pass secrets securely without committing
- Matrix Testing: Test matrix builds before pushing
- Artifact Handling: Capture and inspect build artifacts
Quick Start
# Run all workflows (default push event)
act
# Run specific workflow
act -W .github/workflows/test.yml
# Run specific job
act -j build
# Simulate pull request event
act pull_request
# Pass secrets
act -s GITHUB_TOKEN=$GITHUB_TOKEN
# List available workflows and jobs
act -l
Prerequisites
# Install act (macOS)
brew install act
# Install act (Linux)
curl https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash
# Docker is required
docker --version # Must be installed and running
Common Patterns
Test Before Push
# Validate test workflow passes
act -j test --dryrun # Preview what would run
act -j test # Actually run tests
# If successful, push
git push origin feature-branch
Debug Failing CI
# Run with verbose output
act -v
# Use specific runner image
act -P ubuntu-latest=catthehacker/ubuntu:act-latest
# Keep container for debugging
act --reuse
Matrix Build Testing
# Run all matrix combinations
act -j build
# Run specific matrix combination
act -j build --matrix os:ubuntu-latest
Runner Images
| GitHub Runner | Act Default | Recommended |
|---|---|---|
ubuntu-latest |
node:16-buster-slim |
catthehacker/ubuntu:act-latest |
ubuntu-22.04 |
node:16-buster-slim |
catthehacker/ubuntu:act-22.04 |
ubuntu-20.04 |
node:16-buster-slim |
catthehacker/ubuntu:act-20.04 |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 144 lines · 0 tokens per session scan D ba0eca3da95f
act-local-ci is a skill published in the GitHub repository FortiumPartners/ensemble (12 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 897 tokens. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
github-actions
Use when authoring or fixing GitHub Actions CI/CD — workflows under .github/workflows, triggers, job matrix, caching, token permissions, OIDC cloud deploys, environment gates, reusable workflows. NOT the Dockerfile or image build strategy (that is docker), NOT the branching model (that is git-workflow), NOT release…
bmad-qa-generate-e2e-tests
Generate end to end automated tests for existing features. Use when the user says "create qa automated tests for [feature]".
knowledge-engineering-quality-and-delivery
A project-wide quality and delivery workflow covering tests, release checks, builds, publishing, and bilingual documentation for Blade Code.
hatch3r-ci-pipeline
Designs and optimizes CI/CD pipelines. Covers stage design, test parallelization, artifact management, and pipeline performance.
joycraft-implement
Execute atomic specs with TDD — read spec, write failing tests, implement until green, wrap up and continue the queue.
verify
Pre-merge verification gate. Build, test, and lint must all pass before marking done or shipping.