Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hannesill/m4 --skill m4-setupgit clone --depth 1 https://github.com/hannesill/m4Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hannesill/m4/m4-setup)<a href="https://agentmods.dev/skills/hannesill/m4/m4-setup"><img src="https://agentmods.dev/badge/skills/hannesill/m4/m4-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hannesill/m4/m4-setup"><img src="https://agentmods.dev/badge/skills/hannesill/m4/m4-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01102 |
| Opus 5.5 | $0.00034 | $0.00441 |
| Sonnet 5.5 | $0.00017 | $0.00220 |
| Haiku 4.5 | $0.00009 | $0.00110 |
Grade A, and why
m4-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
M4 setup and repair
Diagnose first; these commands only read:
m4 doctor --json # Python, m4 and duckdb imports, backend, BigQuery project and credentials
m4 list-datasets --json # per dataset: prepared, setup_state ("ready" when usable), derived tables
m4 agent-env --json # data directory, M4 environment variables, path_recommendations.python
vitrine doctor --json # Vitrine version and its Python
vitrine status --json # this folder's study store and its server
Run them, and everything else, with the Python environment M4 is installed in:
path_recommendations.python names it (in an M4 checkout, uv run m4 ...).
| Symptom | Cause | Fix |
|---|---|---|
import m4 or import vitrine fails |
Another Python | Use the environment above |
ConnectionError: Database file not found |
The dataset is not set up (setup_state is not ready) |
The user sets it up: m4 init mimic-iv-demo downloads the open demo; credentialed datasets need their PhysioNet login. Ask before starting either |
| The user's own CSV files are not a dataset yet | Only a definition in M4's datasets folder makes them one | m4 define-dataset NAME --src DIR --dry-run --json lists the tables it would make. With the user's OK, run it without --dry-run, then m4 init NAME --src DIR. M4 reads .csv and .csv.gz files at most one folder deep: ask before moving or renaming the user's files. Report init's conversion_warnings (Latin-1, decimal commas kept as text) to the user |
| A MIMIC-CXR-JPG cohort has no images yet | Only its tables are downloaded; images are fetched per cohort | m4 fetch-images mimic-cxr-jpg --from-csv cohort.csv (a column image_path or dicom_id) succeeds without a login when every image is on disk; otherwise it says missing_credentials, and needs the user's OK and their PhysioNet login. About 1.5 MB per image at 1-17 KB/s per connection, four at a time: tell the user it can take hours. physionet_access_forbidden means the account has not signed the MIMIC-CXR-JPG agreement, which MIMIC-IV access does not include. Running it again resumes |
| The user wants a dataset gone, to free disk or start over | m4 remove-dataset removes M4's copy |
Only when the user asked: show them m4 remove-dataset NAME --dry-run --json first, then run it without --dry-run. Their own folder is kept. Add --keep-definition to keep a custom dataset defined |
ConnectionError: ... locked by another process |
Another process holds the DuckDB file | Wait for it, or ask the user which process to close |
Schema mimiciv_derived does not exist |
Derived tables are built per dataset, and only for full MIMIC-IV | m4 init-derived mimic-iv takes minutes: ask first. On the demo, compute concepts from the clinical skills' SQL |
| Data or settings from the wrong place | M4_DATA_DIR (the data folder itself) beats M4_HOME, which beats the nearest m4_data above the working directory |
m4 agent-env --json shows what M4 resolved |
| Wrong backend, BigQuery project, or database file | M4_BACKEND, M4_PROJECT_ID, and M4_DB_PATH override config.json |
If one of them is set, the user corrects or unsets it first; then m4 backend duckdb, or m4 backend bigquery --project-id ID with GOOGLE_APPLICATION_CREDENTIALS set |
| An agent lacks M4's skills | Not installed for that tool | m4 skills catalog --json lists what this M4 version ships; m4 skills --tools claude,codex installs them into the current project's .claude/skills and .codex/skills. When a host app manages the skills, repair through the host |
| The board shows no new cards | The script published from another folder, so to another store | vitrine status --json in the project folder shows its store; run the script from that folder or set VITRINE_DATA_DIR. show() starts a stopped server; a host app's board needs that same server, so let it run |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines a8658bb4e1ec
- 6d ago Changed · +2 lines · +11 tokens per session 430de6a0c80a
- 7d ago Changed · -75 lines · +30 tokens per session 95444fc92c3b
- 1mo ago Changed · +1 lines c1b61ae8ceea
- 1mo ago First seen · 108 lines · 44 tokens per session scan A 835e7a1c75d7
m4-setup is a skill published in the GitHub repository hannesill/m4 (46 stars, last pushed 2d ago), licensed MIT. It adds 85 tokens to every session and 1,102 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
resolve-handoff
Emit the complete Resolve handoff with exact modes, outcomes, test evidence, and publication state.
iterate-implementation
Only use when the user explicitly invokes this skill by name.
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
typescript-testing
Select and run TypeScript SDK verification for packages, examples, type checks, linting, builds, Vitest suites, Effect v4 CLI tests, and runtime E2E tests. Use when adding tests, diagnosing TypeScript CI, choosing a focused test command, validating TypeScript package changes, or writing/porting CLI tests against…
cli-e2e
Write, modify, or debug Docker-based Composio CLI end-to-end tests under ts/e2e-tests/cli, including binary invocation, fixture isolation, output assertions, and package manifests. Use for CLI E2E test suites only; use cli-command for CLI source implementation.
potpie-cli
Use when the task is centered on running, explaining, configuring, or troubleshooting the potpie command: doctor, login, pot management, source registration, resolve/search/record, graph workbench reads/writes, resource (document payload) commands, and pot scope behavior.