Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hashgraph-online/awesome-codex-plugins/deploy-operatornpx skills add hashgraph-online/awesome-codex-plugins --skill deploy-operatorgit clone --depth 1 https://github.com/hashgraph-online/awesome-codex-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00045 | $0.00437 |
| Opus 5 | $0.00023 | $0.00218 |
| Sonnet 5 | $0.00009 | $0.00087 |
| Haiku 4.5 | $0.00005 | $0.00044 |
Grade A, and why
deploy-operator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Инженер деплоя
Правило активации
Если пользователь не работает через автопилот, для обычного деплоя должны использоваться общие deploy-skills, а не этот внутренний role-skill.
Ты отвечаешь за то, чтобы проект можно было реально довести до запуска.
Вход
verification-report.mdimplementation-plan.mdtech-context.mdstate.json
Выход
env-secrets-checklist.mdfinal-handoff.mdscorecard.md- обновленный
state.json
Обязан
- разделять обязательные и опциональные секреты
- писать, где их брать и куда вставлять
- явно разделять клиентские и серверные ключи
- писать, что нельзя хранить в браузере, боте или публичном коде
- объяснять запуск и деплой простыми словами
- не оставлять пользователя с “додумай сам”
Deploy-подход Morecil
Ты закрываешь последний разрыв между “код есть” и “это можно запустить”.
Твоя задача — сделать запуск скучным и понятным, а не героическим.
Запрещено
- завершать проект без env checklist
- писать handoff без ручных шагов
- скрывать остаточные риски
Самопроверка
- пользователь поймет, что ему делать руками?
- все секреты перечислены?
- указано, какие ключи сильные и где им можно жить?
- можно ли запустить проект по handoff без догадок?
Финальный handoff
Финальный handoff должен отвечать на четыре вопроса:
- что уже готово
- что нужно сделать руками
- где брать секреты и настройки
- какие риски остались после первой версии
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 64 lines · 45 tokens per session scan A dcdea19a0a04
deploy-operator is a skill published in the GitHub repository hashgraph-online/awesome-codex-plugins (859 stars, last pushed 4d ago), licensed Apache-2.0. It adds 45 tokens to every session and 437 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
search
Search 2500+ curated ChatGPT and LLM open-source repositories. Use when the user asks to find tools, libraries, or repos related to ChatGPT, LLMs, RAG, agents, langchain, NLP, AI development, or any open-source AI tooling.
preview-verdicts
Generate the interactive keep/drop verdict preview (HTML page with per-row feedback controls) whenever a prune sweep, batch entry edit, or restructure needs maintainer review before touching README.md — and process the feedback JSON the maintainer pastes back.
sprr
Single PR reviewer for awesome-quant. Use when the user asks to review, validate, comment on, label, close, or merge one specific pull request that adds README.md entries. Triggers include "sprr", "review PR", "check PR", and "validate contribution".
bprr
Bulk PR reviewer for awesome-quant. Use when the user asks to review all open PRs, review unreviewed PRs, bulk review, or mentions "bprr". Reviews open PRs lacking the reviewed label and presents a summary before any merge/comment/label action.
check-mcp-json
Safely review, triage, repair, and merge ToolSDK MCP Registry package JSON pull requests. Use when an agent needs to validate files under packages/, detect duplicate registry keys, classify community PRs, make authorized fixes on contributor branches, close invalid or duplicate PRs, or squash-merge approved PRs.
awesome-web-security
Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive tooling, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive and educational use only.