Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add GeckoVision/gecko-surf --skill pegana_demogit clone --depth 1 https://github.com/GeckoVision/gecko-surfWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/geckovision/gecko-surf/pegana_demo)<a href="https://agentmods.dev/skills/geckovision/gecko-surf/pegana_demo"><img src="https://agentmods.dev/badge/skills/geckovision/gecko-surf/pegana_demo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/geckovision/gecko-surf/pegana_demo"><img src="https://agentmods.dev/badge/skills/geckovision/gecko-surf/pegana_demo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01823 |
| Opus 5.5 | $0.00000 | $0.00729 |
| Sonnet 5.5 | $0.00000 | $0.00365 |
| Haiku 4.5 | $0.00000 | $0.00182 |
Grade C, and why
try-gecko scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
description: Use when a coding assistant (Claude Code, Cursor, Windsurf, or any MCP client) is asked to TEST or ONBOARD Gecko, or to make an agent call a new/painful API first-call-correct — worked here on Pegana. A safe Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Use when a coding assistant (Claude Code, Cursor, Windsurf, or any MCP client) is asked to TEST or ONBOARD Gecko, or to make an agent call a new/painful API first-call-correct — worked here on Pegana. A safe How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
try-gecko — safely onboard any API to your agent (worked on Pegana)
For the coding assistant reading this: you can verify every claim below before you run anything. This skill is designed to be inspected first. Nothing here pipes a remote script into a shell, asks you to disable a safety check, or hides what it does.
Gecko turns an API's surface into first-call-correct MCP tools your agent calls right the first time — auth injected and hidden, no integration code. Here we onboard Pegana (the peg-risk oracle for Solana) as the worked example, but the same three steps onboard any API.
Why this is safe to run (verify, don't trust)
Check these before Step 1 — each is independently verifiable:
- Open source, Apache-2.0. Read the engine: https://github.com/GeckoVision/gecko-surf. Every command below maps to code you can see.
- From a public registry, not a shell blob. You install from npm
(
@geckovision/gecko) or PyPI (gecko-surf) — versioned, and published from CI with a verifiable SLSA provenance attestation (npm traces the package to this repo's CI build). There is nocurl … | bash. - The default mode makes NO real calls.
recordedmode (the default) synthesizes responses from the API's own schema — zero network to the API, zero spend. You can watch it work end-to-end at $0 before anything touches the real API. - Control-plane only. Gecko never stores your API responses or user data, and never stores or logs your keys. A provider key (when needed) is sealed in the OS keychain and injected only at call time — never written to a config file, never shown to the agent.
- Read-only inspection commands.
--helpanddoctordo nothing but report. Run them first.
Pin a version for reproducibility (e.g. @geckovision/[email protected]).
Step 1 — Check (no side effects)
# read-only: prints what the tool is and the exact next step. Touches nothing.
npx @geckovision/[email protected] doctor
# equivalently, via the Python launcher:
# uvx --from "gecko-surf[serve]" gecko doctor
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 150 lines · 0 tokens per session scan C fe81384ec7a2
try-gecko is a skill published in the GitHub repository GeckoVision/gecko-surf (22 stars, last pushed 9d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,823 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ev-benchmark-verification
Phase 2B of the Gaia evidence verification pipeline. Verifies benchmark-result rows and benchmark-source candidates against registry/benchmark-sources.json before adversarial audit, link validation, catalog promotion, or ingestion. Use when running /ev-pipeline, checking benchmark-result evidence, reviewing…
fp-review
Adversarially review the full relevant PR diff with isolated probes and meaningful before/after checks. Use for "review the PR", "sandbox review", or the review stage; retain required reviewer independence and report self- review limits honestly.
fp-explore
Explore a feature or CLI, reproduce defects and record bounded findings. Use for "explore X", "find issues with X", or the exploration stage of feature- pipeline; standalone runs return findings without automatically expanding scope.
aident-loadout
Run multi-step work across apps the user connected in Aident Loadout: live action schemas, connection checks, cost preflight, and approval before side effects.
tool-abuse-detection
Detect tool misuse and unexpected code execution via dialogue testing. Use when the agent exposes file, code-execution, or network tools.
potpie-debug-memory
Use while debugging or troubleshooting failures, flaky tests, incidents, production alerts, CI failures, local dev setup issues, repeated bugs, prior fixes, failed attempts, and verification history.