Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Gldywn/gatekeeper --skill update-gatekeepergit clone --depth 1 https://github.com/Gldywn/gatekeeperWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gldywn/gatekeeper/update-gatekeeper)<a href="https://agentmods.dev/skills/gldywn/gatekeeper/update-gatekeeper"><img src="https://agentmods.dev/badge/skills/gldywn/gatekeeper/update-gatekeeper/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gldywn/gatekeeper/update-gatekeeper"><img src="https://agentmods.dev/badge/skills/gldywn/gatekeeper/update-gatekeeper.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.02357 |
| Opus 5.5 | $0.00034 | $0.00943 |
| Sonnet 5.5 | $0.00017 | $0.00471 |
| Haiku 4.5 | $0.00009 | $0.00236 |
Grade D, and why
update-gatekeeper scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
There is nothing to compare here, because what matters is how it is registered rather than what is on disk. Read the entry, then answer for the setup you actually find. It lives in `~/.claude.json` for Claude Code at use Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$plugins/gatekeeper/dist" # only once the listing above checks out Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
version="$(curl -sS https://api.github.com/repos/Gldywn/gatekeeper/releases/latest | grep '"tag_name"' | head -1 | sed 's/.*"v\{0,1\}\([0-9][^"]*\)".*/\1/')" How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update Gatekeeper
Three pieces can be out of date independently, and each one updates differently. Report the state of all three, even the ones that are current, then act only on what is behind. An update that touches nothing and says so plainly is a good outcome, not a wasted run.
If nothing is installed, this is the wrong skill: hand it to install-gatekeeper and stop.
Pairing survives an update. The plugin keeps its token in Beekeeper's encrypted storage under the plugin id, not in its folder, so replacing the folder does not cost a new 6-digit code. Say that up front, because the opposite is what people expect.
The latest version
One call, and it covers two of the three pieces: the plugin and the MCP server ship under one version and are meant to match.
version="$(curl -sS https://api.github.com/repos/Gldywn/gatekeeper/releases/latest | grep '"tag_name"' | head -1 | sed 's/.*"v\{0,1\}\([0-9][^"]*\)".*/\1/')"
echo "$version"
The snippets below reuse that $version.
Check that npm already serves it before touching the plugin or the server, with the package manager the human uses: npm view @gldywn/gatekeeper-mcp-server@"$version" version, or pnpm view with the same arguments, prints the version back once it is installable. A release shows on GitHub as soon as it is published, but npm serves the server only after a maintainer approves the staged upload, so for a while GitHub is ahead, and updating then would leave the plugin ahead of the server or pin a version npm cannot serve. If npm answers that the version does not exist (E404), the release is still being published: report the state of the three pieces, leave the plugin, the server config and the running servers as they are, and tell the human to run this again shortly. If npm cannot be reached, or you cannot run it, hold the plugin and the server all the same and say so, since that confirms nothing either way. The skills (Piece 3) do not depend on npm and can still be updated.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago Changed · +2 lines 893443b5b024
- 25d ago Changed · +14 lines e2f660953565
- 1mo ago Changed 5de2caeab8a8
- 1mo ago Changed · +8 lines scan B → D a4ffc98c4d8b
- 2mo ago First seen · 96 lines · 86 tokens per session scan B 01d5bc85f799
update-gatekeeper is a skill published in the GitHub repository Gldywn/gatekeeper (2 stars, last pushed 5d ago), licensed MIT. It adds 86 tokens to every session and 2,357 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it D with 3 findings (reads agent configuration directories, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
database-migration
Generate, review, test, and deploy database schema migrations. Use when adding columns, creating tables, or changing schema.
staging-deploy
Build, push, migrate, and deploy to staging environment with health check verification. Use when deploying a completed phase to staging.
supabase-migration
A procedure for changing a Supabase database schema, which defines tables, columns, relationships, and access rules. It covers creating migrations, checking row-level security (RLS), validating locally, and regenerating TypeScript types.
rls-policy
Write and test Supabase/Postgres Row-Level Security policies so users can only access their own rows. Use when a table holds user data, when enabling RLS, or when auditing access control on Supabase.
db-backup-restore
Safely back up and restore a Postgres/Supabase database — pgdump/pgrestore, Supabase backups/PITR, and a no-data-loss restore runbook. Use before risky migrations, for disaster recovery, or when cloning prod to staging.
migration-safety
Generate safe, reversible Postgres/Supabase migrations using the expand→backfill→contract pattern, avoiding locks and data loss. Use when altering schema, adding/removing columns, or changing types on tables that already hold data.