Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/harnios/harnios-mcp/setup-envnpx skills add harnios/harnios-mcp --skill setup-envgit clone --depth 1 https://github.com/harnios/harnios-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/harnios/harnios-mcp/setup-env)<a href="https://agentmods.dev/skills/harnios/harnios-mcp/setup-env"><img src="https://agentmods.dev/badge/skills/harnios/harnios-mcp/setup-env.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01424 |
| Opus 5 | $0.00023 | $0.00712 |
| Sonnet 5 | $0.00009 | $0.00285 |
| Haiku 4.5 | $0.00005 | $0.00142 |
Grade A, and why
setup-env scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
frontend/.env.example documents every variable the Next.js app reads (S3/storage connection, OAuth owner credential, MCP bootstrap path, OS_NAME branding, etc.). Next.js loads config from any file starting with .env (.env, .env.local, .env.development, .env.development.local, .env.production.local, etc.) — there is no single fixed filename, and several such files can coexist for different purposes (e.g. one per environment/deployment). frontend/.gitignore covers all of them with a blanket .env* pattern (except .env.example itself, which is intentionally tracked as the template) — none of them are ever committed.
This skill exists so any one of these files can be created or updated without the user having to hand-copy and decode .env.example themselves.
Steps
-
Determine the target filename — never assume
.env.local. List everyfrontend/.env*file that currently exists (excluding.env.example). Ask the user (AskUserQuestion) which file this run targets:- Each existing
.env*file found, offered as an option ("update<name>") - "Create a new one" — if chosen, ask for the filename (must start with
.env); tell the user which Next.js env file it corresponds to if the name implies a specific load order (.env.localloads everywhere;.env.development/.env.productionare environment-specific; the.localvariants are per-machine overrides not meant to be shared) - If exactly one
.env*file already exists, you may skip this question and confirm your assumption in one line instead of formally asking (e.g. "I'll update the existing.env.local") — only ask when there's a real choice (multiple existing files, or none yet)
- Each existing
-
Read
frontend/.env.exampleand parse it into an ordered list of variables. For each variable, capture:- Its
KEY - The full comment block immediately above it (this is the human-readable description — use it verbatim when asking the user, don't paraphrase it away)
- Its example value, and whether that value is a usable default as-is (e.g.
S3_REGION=us-east-1,S3_FORCE_PATH_STYLE=true) or a placeholder that must be replaced for anything beyond the exact local-MinIO setup this repo ships with (e.g.S3_ENDPOINT,S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEYwhen not using the bundled local MinIO,OAUTH_OWNER_PASSWORDwhich ships empty on purpose)
- Its
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 46 lines · 47 tokens per session scan A 6b3d5d6e5633
setup-env is a skill published in the GitHub repository harnios/harnios-mcp (1 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 1,424 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gh-issues
Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5]…
canvas
Display HTML content on connected OpenClaw nodes (Mac app, iOS, Android).
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
gog
Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
himalaya
CLI to manage emails via IMAP/SMTP. Use himalaya to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
node-connect
Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps. Use when QR/setup code/manual connect fails, local Wi-Fi works but VPS/tailnet does not, or errors mention pairing required, unauthorized, bootstrap token invalid or expired, gateway.bind, gateway.remote.url, Tailscale…