Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hecatehq/hecate --skill maintenancegit clone --depth 1 https://github.com/hecatehq/hecateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hecatehq/hecate/maintenance)<a href="https://agentmods.dev/skills/hecatehq/hecate/maintenance"><img src="https://agentmods.dev/badge/skills/hecatehq/hecate/maintenance.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00615 |
| Opus 5 | $0.00000 | $0.00308 |
| Sonnet 5 | $0.00000 | $0.00123 |
| Haiku 4.5 | $0.00000 | $0.00061 |
Grade A, and why
hecate-maintenance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hecate maintenance skill
Routine upkeep should be boring, isolated, and easy to review. Use this skill when the task is maintenance-shaped rather than feature-shaped.
When to use
- Running recurring health checks or preparing a maintenance PR.
- Cleaning up stale local worktrees or branches.
- Checking whether merged work can be pruned safely.
- Removing stale docs, screenshots, anchors, product language, or agent guidance.
- Reviewing dependency drift across Go, UI, website, Tauri/Rust, Docker, or GitHub Actions.
- Keeping CI/local verification recipes aligned.
- Updating scheduled nightly maintenance checks and report behavior.
Read first
../../tasks/maintenance.md— cadence, hygiene rules, and maintenance-specific verification.../../core/verification.md— broader verification ladder when maintenance touches risky runtime surfaces.
Default flow
- Start from current
master, preferably in a fresh maintenance worktree. - Run
git fetch origin master --prunebefore starting a new maintenance PR. - Run
just branches-reportwhen cleanup might involve branches or worktrees. - Make only maintenance-scoped edits. Keep behavior changes and dependency bumps in separate PRs unless the operator explicitly asks to combine them.
- Run
just docs-checkfor docs-only maintenance orjust maintenancefor broader upkeep. - Summarize what was checked, what was intentionally skipped, and which cleanup candidates still need operator judgment.
For nightly workflow changes, run just maintenance-nightly when feasible. If
that is too expensive for the turn, run just maintenance plus the narrow
script/workflow checks and say exactly what was skipped.
Guardrails
- Treat
just branches-reportas evidence, not permission to delete. - Do not remove a worktree with uncommitted changes.
- Do not delete a branch with an open PR or unique commits not represented on
origin/master. - Do not let stale-product-language cleanup rewrite technical terms that still describe real internals, such as the gateway HTTP path or gateway OTel spans.
- Do not hide flaky external URL failures inside the hard-fail local gate. Use
just check-links-externalwhen external rot is the task.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 64 lines · 0 tokens per session scan A fd44e228adde
hecate-maintenance is a skill published in the GitHub repository hecatehq/hecate (22 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 615 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
new-project
Bootstrap a new product repository for agentic development. Use when starting a new app, empty repo, greenfield project, or when the user asks to stand up the factory, the start loop, or what to install before the first feature.
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
fanout
Run independent subtasks in parallel — one git worktree and one implementation sub-agent per task, each opening its own PR — then cross-review every PR. polly never merges; the human does.
meta-codereview-current-diff
Read the current uncommitted diff, run three independent reviewers (safety + tests-coverage + style) in parallel, then arbitrate a single BLOCK / BLOCKWITHOVERRIDE / PASSWITHNOTES verdict. Use before commit when you want a multi-perspective second-opinion instead of a single-reviewer agent loop.