Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/greglas75/zuvonpx agentmods add skills/greglas75/zuvo/canaryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greglas75/zuvo/canary)<a href="https://agentmods.dev/skills/greglas75/zuvo/canary"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/canary/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/greglas75/zuvo/canary"><img src="https://agentmods.dev/badge/skills/greglas75/zuvo/canary.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02351 |
| Opus 5.5 | $0.00025 | $0.00940 |
| Sonnet 5.5 | $0.00013 | $0.00470 |
| Haiku 4.5 | $0.00006 | $0.00235 |
Grade A, and why
canary scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- If browser network data is unavailable: run a degraded-mode `curl` request against the same URL for status verification. How it starts
The opening of the file, as written. The whole thing — 246 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zuvo:canary
Monitor production after deployment. Browser-based or HTTP-only health checks with configurable duration.
Argument Parsing
| Argument | Effect |
|---|---|
<url> |
Production URL to monitor (REQUIRED) |
--duration <time> |
Monitoring duration (default: 10m, range: 1m-30m) |
--interval <time> |
Check interval (default: 60s) |
--quick |
Single health check, no loop |
--max-errors <n> |
Error threshold for FAIL verdict (default: 3) |
Mandatory File Loading
Before starting any phase, read these shared includes:
INCLUDES LOADED:
1. ../../shared/includes/env-compat.md — READ
2. ../../shared/includes/run-logger.md — READ
3. ../../shared/includes/retrospective.md — READ
Phase 0: Setup
Step 1: Validate URL
If no URL argument is provided, STOP immediately:
URL is required. Usage: zuvo:canary https://myapp.com
Step 2: Detect Browser Capability
Check whether the current environment exposes browser automation tools compatible with Playwright or Chrome DevTools.
-
If browser tooling is available: set
MODE=full. -
If not: set
MODE=degradedand print:[DEGRADED: no browser tools] — running HTTP-only checks. Console errors and screenshots unavailable.
Step 3: Check Environment (per env-compat.md)
If running in a non-interactive environment (Codex App, Cursor):
-
Default to
--quickbehavior (single check) only if no--durationwas explicitly passed. -
If the user explicitly passed
--duration: honor it — run the full monitoring loop. Non-interactive environments can execute timed loops; the limitation is user interaction, not execution duration. -
Print:
[AUTO-DECISION]: defaulting to one-shot mode. Pass --duration to enable monitoring loop.
Step 4: Parse Arguments
Parse --duration and --interval. Validate duration range (1m–30m inclusive). If duration is outside this range, stop with:
--duration must be between 1m and 30m. Got: <value>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 246 lines · 63 tokens per session scan A 3ceef874447b
canary is a skill published in the GitHub repository greglas75/zuvo (8 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 2,351 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
changelog
Add CHANGELOG.md entries, derive them from commits, or cut a Keep a Changelog and SemVer release.
wrap-up-branch
Finish a feature branch: add missing tests, review and fix the code, align docs, then merge only after explicit confirmation.
resolve-merge
Resolve an active merge or rebase conflict, including safe renumbering of colliding plans and chronicles.
commit
Create a user-requested Conventional Commit from the staged changes.
kanso-pr
Use when the user asks to write a pull request description, open a PR, draft PR notes, or summarise a branch for review.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…