Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gotempsh/temps --skill estimate-temps-savingsgit clone --depth 1 https://github.com/gotempsh/tempsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gotempsh/temps/estimate-temps-savings)<a href="https://agentmods.dev/skills/gotempsh/temps/estimate-temps-savings"><img src="https://agentmods.dev/badge/skills/gotempsh/temps/estimate-temps-savings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gotempsh/temps/estimate-temps-savings"><img src="https://agentmods.dev/badge/skills/gotempsh/temps/estimate-temps-savings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 98 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 99 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00292 | $0.02599 |
| Opus 5 | $0.00146 | $0.01300 |
| Sonnet 5 | $0.00058 | $0.00520 |
| Haiku 4.5 | $0.00029 | $0.00260 |
Grade A, and why
estimate-temps-savings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Estimate Temps Savings
Scan the current project, detect every paid SaaS tool it depends on, estimate the monthly bill, and show the delta against running Temps instead. The output is a savings report the user can act on (or show their team).
Temps is a self-hosted PaaS that replaces the deployment platform, web analytics, session replay, error tracking, uptime monitoring, managed databases, and transactional email relay with a single binary. Self-hosting is free (you pay only for the server); Temps Cloud is a managed server at cost + 30% (from ~$6/mo).
Ground Rules
- Never read or print secret values. Detection uses dependency names, config file presence, env var key names, and the hostname of connection strings only. If you must open a
.env*file, extract key names (cut -d= -f1) — never echo values into the report or your reasoning. - No vanity math. Only count tools you actually detected. If a tool has a free tier the user likely fits in (e.g. Google Analytics, small Sentry dev plan), say so and count $0 or a range starting at $0. An inflated savings number destroys trust; an honest one converts.
- Ranges, not fake precision. You don't know the user's plan. Report low/typical estimates and label them as list-price estimates. If exact numbers matter, tell the user which invoices to check.
- Be honest about what Temps does NOT replace (see the "Not replaced" section below). Always include it in the report.
Step 1 — Detect the Stack
Run these checks from the project root. Check dependency manifests (package.json, requirements.txt, pyproject.toml, Gemfile, go.mod, Cargo.toml), config files, CI workflows (.github/workflows/), and env var key names in .env*, .env.example, docker-compose*.yml, and IaC files.
| Category | Signal → Tool |
|---|---|
| Hosting | vercel.json or .vercel/ → Vercel · netlify.toml → Netlify · railway.json/railway.toml → Railway · render.yaml → Render · fly.toml → Fly.io · Procfile + no Dockerfile → Heroku · amplify.yml → AWS Amplify |
| Analytics | posthog-js/posthog-node → PostHog · plausible-tracker or plausible.io script tag → Plausible · mixpanel-browser → Mixpanel · @amplitude/* → Amplitude · fathom-client → Fathom · @segment/analytics-* → Segment · @vercel/analytics → Vercel Analytics |
| Error tracking | @sentry/*, sentry.properties, sentry-sdk → Sentry · @bugsnag/* → Bugsnag · rollbar → Rollbar · @honeybadger-io/* → Honeybadger |
| Session replay | logrocket → LogRocket · @fullstory/browser → FullStory · Hotjar script tag / HOTJAR_ID → Hotjar · @highlight-run/* → Highlight · PostHog with session_recording config → PostHog Replay |
| Uptime / status | checkly.config.ts → Checkly · env keys or CI mentioning Pingdom / UptimeRobot / Better Stack (BetterUptime) / Statuspage |
| Managed DB / cache | @supabase/supabase-js or supabase.co host → Supabase · @neondatabase/serverless or neon.tech host → Neon · @planetscale/database or psdb.cloud host → PlanetScale · mongodb+srv:// or mongodb.net host → MongoDB Atlas · @upstash/redis or upstash.io host → Upstash · rds.amazonaws.com host → AWS RDS · redns.redis-cloud.com host → Redis Cloud |
| Transactional email | @sendgrid/mail / SENDGRID_API_KEY → SendGrid · postmark / POSTMARK_SERVER_TOKEN → Postmark · resend / RESEND_API_KEY → Resend · mailgun.js / MAILGUN_API_KEY → Mailgun · email-smtp.*.amazonaws.com → AWS SES (already cheap — flag, don't count) |
| Observability (partial) | DD_API_KEY/datadog → Datadog · NEW_RELIC_LICENSE_KEY → New Relic (Temps covers logs/metrics/traces basics — count partially, note the caveat) |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 121 lines · 292 tokens per session scan A 9d671a515d31
estimate-temps-savings is a skill published in the GitHub repository gotempsh/temps (733 stars, last pushed today), licensed Apache-2.0. It adds 292 tokens to every session and 2,599 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
scanning-docker-images-with-trivy
Trivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violati.
performing-container-security-scanning-with-trivy
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
devops-deployment
Use when setting up CI/CD pipelines, containerizing applications, deploying to Kubernetes, or writing infrastructure as code. DevOps & Deployment covers GitHub Actions, Docker, Helm, and Terraform patterns.
add-ci-area
Add a new project area to CI workflows.
ci-status
Check the CI pipeline status for the current branch after pushing changes. Reports pass/fail with failure details. Use this after every push to confirm your changes are truly done — CI must be green. TRIGGER when: after git push, after committing changes, when asked to check CI, or when verifying that work is complete.
deployment
Use when taking an app from source to live: choosing the deploy target from requirements (Hetzner+Coolify vs Vercel vs a third), then wiring container → CI → registry → host with build secrets, healthchecks and rollback. NOT one platform's mechanics (that is coolify, vercel, railway, render), NOT the Dockerfile alone…