Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gotempsh/temps/start-tempsnpx skills add gotempsh/temps --skill start-tempsgit clone --depth 1 https://github.com/gotempsh/tempsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00207 | $0.06207 |
| Opus 5 | $0.00103 | $0.03104 |
| Sonnet 5 | $0.00041 | $0.01241 |
| Haiku 4.5 | $0.00021 | $0.00621 |
Grade D, and why
start-temps scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 "$claim/root-id" Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf -- "$TEMPS_DATA_DIR" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w "console /readyz -> %{http_code}\n" http://localhost:$TEMPS_CONSOLE_PORT/readyz How it starts
The opening of the file, as written. The whole thing — 501 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Start a local Temps server
Boots the temps binary from source (cargo run --bin temps --package temps-cli -- serve ...) for quick local iteration, no debugger required. See
CONTRIBUTING.md for the one-shot manual version of this; this skill adds
port isolation across worktrees and a repeatable restart flow.
Prerequisites
-
The database container from
CONTRIBUTING.md("Database" section) running and reachable, e.g.:docker run -d --name temps-db --restart unless-stopped \ -p 127.0.0.1:5432:5432 \ -v temps-db-data:/home/postgres/pgdata/data \ -e POSTGRES_USER=temps -e POSTGRES_PASSWORD=temps -e POSTGRES_DB=temps \ timescale/timescaledb-ha:pg18If your container has a different name, user, password, or port, set
TEMPS_DEV_DB_CONTAINER/TEMPS_DEV_DB_URL_BASEbefore running step 0, or just edit the generated slot env file afterwards. -
bun installalready run in<checkout>/web. -
Docker running, if you'll exercise features that shell out to it (container deploys, agent sandboxes, etc.) — see the Docker precheck below.
Port slots — read this first
If you keep multiple worktrees of this repo around (one per branch/PR), the
naive approach — hardcode :8080 / :3000 and kill whatever's listening —
means starting temps in worktree B kills the server another session was using
in worktree A. This skill instead assigns each checkout a slot (0–29) and
derives every port from it:
| Thing | Port | Slot 0 |
|---|---|---|
Backend HTTP (--address) |
8080 + slot*10 |
8080 |
Console (--console-address) |
8081 + slot*10 |
8081 |
TLS (--tls-address) |
8443 + slot*10 |
8443 |
| Parked address (split mode only) | 8085 + slot*10 |
8085 |
Web dev server (bun dev) |
3000 + slot |
3000 |
| Database | temps_s<slot> |
temps |
TEMPS_DATA_DIR |
<checkout>/crates/temps-cli/temps_data |
same, per checkout |
Rules:
- All listeners bind to
127.0.0.1by default. LAN exposure is not part of this workflow; configure TLS and strong non-development credentials before opting into a non-loopback bind. - The first checkout you run step 0 in claims slot 0, so the familiar
http://localhost:3000/:8080belong to whichever worktree you started first (usually your primary clone). - Every other checkout gets the lowest free slot ≥ 1, and keeps it — the
claim is recorded atomically in
~/.temps-dev/slot-<N>.claim/with its mode-0600 state inslot-<N>.env, so restarting temps in the same worktree always lands on the same ports. Existing claims remain reserved until explicitly released with step 7, even while their server is stopped. - The kill step verifies the listening process's cwd is inside this checkout before killing it. If it isn't, stop and report rather than killing it — that process belongs to another session.
- The ranges never overlap (HTTP 8080–8370, parked 8085–8375, TLS 8443–8733, web 3000–3029). If you run other local services in the 8080–8730 or 3000–3029 range, expect port contention and free a slot (step 7) or shift the base ports in this skill.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 501 lines · 207 tokens per session scan D a9e85cddf3c2
start-temps is a skill published in the GitHub repository gotempsh/temps (700 stars, last pushed 3d ago), licensed Apache-2.0. It adds 207 tokens to every session and 6,207 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debugging-output-and-previewing-html-using-ray
Use when user says "send to Ray," "show in Ray," "debug in Ray," "log to Ray," "display in Ray," or wants to visualize data, debug output, or show diagrams in the Ray desktop application.
fortify-development
ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), passkeys, profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions…
timeboxed-iterating
Use when the user specifies a task and a duration, and the work should be done iteratively by subagents over that time period.
project-snmp-profiles-authoring
Use when editing Netdata SNMP profile YAMLs, topology SNMP profiles, ddsnmp profile parsing, or profile-format documentation. Requires checking source MIB field accessibility, especially MAX-ACCESS not-accessible INDEX objects, before adding or changing profile symbols.
learn-pr-preview
Use only when the user explicitly asks to build, run, preview, inspect, or validate learn.netdata.cloud locally using the contents of a PR or documentation branch before merge. Do not trigger for ordinary docs edits unless the user asks for a local Learn preview.
human-approval
Request human approval before performing a SAFETY-CRITICAL, IRREVERSIBLE, or SCOPE-EXPANDING action — submit a structured context (action, scope, risk, consequence) plus options, then STOP the current turn. The platform redispatches the agent after the human decides. NEVER use for routine deliverables (writing docs /…