Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gug007/lpm/lpm-clinpx skills add gug007/lpm --skill lpm-cligit clone --depth 1 https://github.com/gug007/lpmWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00098 | $0.01391 |
| Opus 5 | $0.00049 | $0.00696 |
| Sonnet 5 | $0.00020 | $0.00278 |
| Haiku 4.5 | $0.00010 | $0.00139 |
Grade A, and why
lpm-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
lpm is a command-line companion to the lpm desktop app. Verify it is available with lpm --version; if it is missing, install it from the lpm app's Settings.
Key facts
- The project name is inferred from
LPM_PROJECT_NAMEor the current directory — omit it inside lpm terminals. - Default output is compact text (cheapest); add
--jsononly when you need to parse the result. - Exit codes:
0ok,2usage / not found / app not running,1failure / timeout. config get,config apply, and control commands need the lpm app running; other inspection commands do not.
Commands
lpm list— all projects, running state, agent counts.lpm project [name] [--full]— one project in full (--fulladds env maps, action details, terminal history).lpm config resolve [--cwd PATH] [--json]— match a directory to its deepest project root without usingLPM_PROJECT_NAME.lpm config validate <file> [--json]— validate syntax, fields, layer rules, and effective merged configuration.lpm config get --layer project|repo|global|template [--project NAME | --template NAME] [--create] [--json]— read a config layer with the revision required for a safe write.lpm config apply --layer project|repo|global|template [--project NAME | --template NAME] [--create] --if-revision HASH (--stdin | --file PATH) [--json]— validate a candidate and atomically apply it through the running app. Never edit a live config file directly.lpm logs [service] [-n 30] [-p proj]— service scrollback, exactly N lines.lpm status [project]— live agent statuses (Running/Waiting/Done/Error).lpm start [project] [--profile X]/lpm stop [project]— start / stop a project's services.lpm service <name> start|stop|restart [-p proj]— one service.lpm wait [project] [--service X | --port N | --agent] [--timeout 60]— block until ready;--agentwaits for the project's agents to settle.lpm duplicate [project] [-n N] [--label TEXT]... [--group X] [--run ACTION | --command CMD] [--prompt TEXT] [--include-uncommitted | --exclude-uncommitted]— create parallel working directories. Always pass a--labeldescribing the copy's purpose so it's identifiable in the app — one repeated--labelper copy in creation order,<project-name>-<short-description>style such aslpm-fix-auth. Only omit it when you genuinely can't infer a purpose. Output lists each copy's path.lpm worktree [project] [-n N] [--label TEXT]... [--group X] [--run ACTION | --command CMD] [--prompt TEXT] [--reinstall-deps]— create linked Git worktrees instead of standalone copies. The same labeling guidance applies. Output lists each worktree's path.lpm remove <copy-name>— remove a duplicate. For a linked worktree, this also removes its Git worktree registration and lpm-created branch. Originals need--force; don't use--forceunless the user explicitly asks.lpm run [action | --command CMD] [--prompt TEXT] [-p proj]— queue in a new app terminal, fire-and-forget.lpm set-status <key> <value>/lpm clear-status <key>— report status to the app UI.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 57 lines · 98 tokens per session scan A 299b559cbc8e
lpm-cli is a skill published in the GitHub repository gug007/lpm (156 stars, last pushed 4d ago), licensed MIT. It adds 98 tokens to every session and 1,391 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
orca-emulator-android
Control an Android emulator / device from inside Orca using the orca CLI. Use for listing/booting AVDs, taps, swipes, typing, hardware buttons (incl. Back and Recents), rotation, app install/launch, runtime permissions, the accessibility tree, and logcat — driving a real adb-connected device or emulator.…
external-context
Invoke parallel document-specialist agents for external web searches and documentation lookup.
security-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for…
change-keybinding
Customize Warp keyboard shortcuts (keybindings, keymappings) by editing the user's keybindings.yaml file. Use when the user asks to remap a key combination, rebind an action, change a shortcut, or remove a default keybinding (e.g. "change ctrl+space to ctrl+s", "rebind the command palette to cmd+p", "remove the…
test-warp-ui
Guides testing Warp UI features and changes using the computer use tool. Use this skill only when computer-use testing was requested (explicit request or accepted offer) and the computeruse tool is available to the agent. Covers launching Warp and verifying UI behavior.
agent-add-mcp
Use this skill when helping users add MCP servers to their Warp configuration.