Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/heapy/kortex/create-tasksnpx skills add Heapy/kortex --skill create-tasksgit clone --depth 1 https://github.com/Heapy/kortexWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.01502 |
| Opus 5 | $0.00031 | $0.00751 |
| Sonnet 5 | $0.00012 | $0.00300 |
| Haiku 4.5 | $0.00006 | $0.00150 |
Grade A, and why
create-tasks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create Tasks
Create only tasks justified by the request. Use the kotgent CLI for tracker operations and git for
repository identity and provenance. Do not use an MCP server, SDK, direct daemon request, or helper script.
Honor the command contract
- Run each
kotgentinvocation as a standalone command. Do not pipe or post-process it inline, merge stderr into stdout, or append anechoof the status; those forms hide the command's real exit code or destroy the stdout/stderr contract. - Treat successful
taskandprojectstdout as one JSON value. Treat failure stderr as one JSON object. - Treat exit
2as a command-construction bug: stderr may be plain usage text. Stop and report the exact command and stderr; do not retry it unchanged. - Never run
project init,project restore, orproject deletein this workflow. - Never delete already-created tasks to roll back a partial batch.
- Resolve the current session from the live kotgent pane by default. Never read
KOTGENT_SESSION_IDas identity or copy it into--session. Use--sessiononly for a caller outside a kotgent pane when the invocation context or user explicitly supplied the exact current session ID.
Preflight
Complete every check before creating the first task:
- Run
git --versionandkotgent --version. Stop if either command is unavailable. - Resolve the repository root with
git rev-parse --show-toplevel. Stop outside a Git worktree. - Establish one identity mode before any tracker mutation:
- In the normal pane mode, run a ref-less
kotgent task show. Accept exit0, or exit1with empty stdout, nostatus, anderrorexactly equal tothis session is not linked to a task — name one, or link one with `kotgent task claim <ref>`. Any other response means pane resolution failed; stop rather than adding--sessionfrom the environment. - Outside a kotgent pane, require an exact session ID explicitly supplied by the invocation context or
user, then run
kotgent task show --session <session-id>. Accept exit0, or exit1with empty stdout, nostatus, anderrorexactly equal tosession '<session-id>' is not linked to a task — name one: kotgent task <command> <ref> --session <session-id>. Never infer an ID from a provider conversation, environment variable, name, cwd, recency, orkotgent list. Keep the chosen mode for the whole run.
- In the normal pane mode, run a ref-less
- Inspect
<root>/.kotgent.jsonand resolve one of these project states:- If the file exists, require valid JSON and a UUID-shaped
id. Runkotgent project list. If it contains that ID, record the live project UUID and runkotgent task list --project <project-uuid>. - If the descriptor's ID is absent from the live list, run
kotgent project list --archived. Stop if that ID is archived; never restore it. If it is absent there too, leave the project unresolved so the first contextualtask addadopts the committed descriptor. - If the file is absent, do not stop and do not run
project init. Leave the project unresolved so the first contextualtask addcreates the descriptor and project.
- If the file exists, require valid JSON and a UUID-shaped
- Resolve the full commit with
git rev-parse HEAD; stop if HEAD does not exist or is not a full SHA. Resolve the branch withgit symbolic-ref --quiet --short HEAD; use the literaldetachedonly when that command reports detached HEAD. - Select the exact active host label:
Codex,Claude Code, orJunie.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 118 lines · 62 tokens per session scan A 3933a911c6d1
create-tasks is a skill published in the GitHub repository Heapy/kortex (5 stars, last pushed 4d ago), licensed Apache-2.0. It adds 62 tokens to every session and 1,502 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mobile-experience-report
Use when the user says 'my site looks bad on mobile', 'check mobile layout', 'responsive audit', or 'site broken on phones'. Diagnoses breakpoint problems, text sizing, column stacking failures, hidden elements, and navigation menu behavior, device by device.
verify-set
Prove a Magic set is actually finished — card-for-card complete, field-for-field faithful to Scryfall, scripts that match their oracle text, tokens that resolve the set's own art, behaviourally sound — then archive its backlog. Builds the Scryfall dump and CardFieldVerificationTest, fans the per-card DSL and token…
add-random-card
Pick a random unimplemented card from a set and implement it. Accepts either a backlog cards.md path or a set name/code.
motherduck-design-dive
Design or redesign a MotherDuck Dive as a responsive, reusable analytics interface. Use when a Dive must be mobile-friendly from the start, support light and dark modes, reserve space for filters, use restrained Power BI-style information design, embed small charts inside metric components, or work across customers…
desktop-expert
Compose Multiplatform Desktop patterns for the desktopApp/ module. Use when working with (1) Desktop-only APIs (Window, WindowState, Tray, MenuBar, Dialog), (2) keyboard shortcuts and menu systems with OS-aware conventions (Cmd vs Ctrl, isMacOS branching), (3) desktop navigation (NavigationRail/sidebar vs Android…
gradle-expert
Build optimization, dependency resolution, and multi-module KMP troubleshooting for AmethystMultiplatform. Use when working with: (1) Gradle build files (build.gradle.kts, settings.gradle), (2) Version catalog (libs.versions.toml), (3) Build errors and dependency conflicts, (4) Module dependencies and source sets, (5)…