Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/greenlv/skillferry/setup-skillferrynpx skills add GreenLv/skillferry --skill setup-skillferrygit clone --depth 1 https://github.com/GreenLv/skillferryWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.00644 |
| Opus 5 | $0.00020 | $0.00322 |
| Sonnet 5 | $0.00008 | $0.00129 |
| Haiku 4.5 | $0.00004 | $0.00064 |
Grade A, and why
setup-skillferry scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
setup-skillferry
Set up and keep a portable agent workspace healthy with skillferry: one versioned, Git-friendly definition of skills, global rules, and MCP connection templates that renders into Codex, Claude Code, and DeepSeek Harness (DSH) — without ever copying secrets or runtime state.
When to use
- Installing skillferry on a new machine or after a reinstall.
- Adding a new agent (target) to an existing workspace.
- Diagnosing
skillferry doctorexit codes 1/2/3. - Deciding whether an asset belongs in the workspace or stays machine-local.
Workflow
- Install:
pipx install skillferry(orpython -m pip install skillferry). Confirm withskillferry --version. - Create or fetch a workspace:
skillferry init my-workspace, or clone the private Git repository that holds your workspace definition. - Preview:
skillferry planin the workspace root. Read the portability grade for every asset —native,translated,degraded,manual,unsupported— and resolve every conflict before applying. - Apply:
skillferry apply. The tool backs up every changed file (recoverable under the local state directory) and writes only files it owns, tracked in a per-path hash ledger. - Verify:
skillferry doctormust exit 0. Exit 2 means safe drift (apply), exit 3 means a human decision (read the conflict reasons). - Check in: commit workspace changes to Git; pull on other machines and
re-run
apply.
Rules of thumb
- Anything a machine owns (auth, sessions, caches, sqlite state, absolute
machine paths) never belongs in the workspace.
[protect]exists to make that refusal explicit. - Secrets are references, not values: MCP env entries are
secret:env/NAMEorsecret:file/PATH. Each machine supplies the real values locally; the shareable export (skillferry export <destination>) never expands them. - The workspace is target-neutral. Use
overlays/platform/*.tomlfor OS differences andoverlays/target/*.tomlfor agent differences — never fork the workspace per agent.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 58 lines · 40 tokens per session scan A f9eadc4e8190
setup-skillferry is a skill published in the GitHub repository GreenLv/skillferry (0 stars, last pushed 3d ago), licensed Apache-2.0. It adds 40 tokens to every session and 644 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
r3f-animation
React Three Fiber animation - useFrame, useAnimations, spring physics, keyframes. Use when animating objects, playing GLTF animations, creating procedural motion, or implementing physics-based movement.
broken-authentication
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for…
burp-suite-testing
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core…
cv-tailor
Optimize resumes by matching keywords to the job description, rewriting experience with the quantified STAR method, and checking ATS compatibility. Triggered when users ask for resume help, review, or polishing, mention JD matching, STAR method, ATS, or want to tailor their resume for a specific role.
metasploit-framework
This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the…
academic-paper-reviewer
Simulates academic peer review, evaluating papers across Originality, Methodology, Results, and Writing to provide Major/Minor Revision recommendations with actionable feedback. Triggers when a user asks to "review my paper," "simulate peer review," or "give my paper a peer review.