Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/holon-run/holon/ghxnpx skills add holon-run/holon --skill ghxgit clone --depth 1 https://github.com/holon-run/holonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/holon-run/holon/ghx)<a href="https://agentmods.dev/skills/holon-run/holon/ghx"><img src="https://agentmods.dev/badge/skills/holon-run/holon/ghx.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01001 |
| Opus 5 | $0.00011 | $0.00500 |
| Sonnet 5 | $0.00004 | $0.00200 |
| Haiku 4.5 | $0.00002 | $0.00100 |
Grade A, and why
ghx scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GHX Skill
Summary
Use this skill as shared guidance for raw gh and gh api usage in GitHub issue, pull request, and review workflows.
It focuses on safe command patterns, payload handling, and common collection/publish recipes.
This skill is guidance-only. It does not provide scripts, wrappers, or executable entrypoints.
When To Use
- Collecting issue or PR context directly from GitHub with
gh - Publishing PR bodies, issue comments, or review replies safely
- Looking for reusable GitHub CLI patterns without depending on repo-local scripts
- Standardizing GitHub CLI safety rules across multiple skills
Do Not Use
- As a command or executable tool
- When a task needs Holon runtime internals rather than GitHub CLI guidance
- As a replacement for the task-specific logic in
github-review,github-pr-fix, orgithub-issue-solve
Prerequisites
ghCLI authentication is required.GITHUB_TOKENorGH_TOKENmust have the scopes required by the target repository operations.jqis recommended when you need structured filtering or JSON post-processing.
Safety Rules
Payload handling
- Never inline large markdown or JSON payloads on the command line.
- Always pass long bodies through files:
gh issue create --body-file <file>gh issue comment --body-file <file>gh pr create --body-file <file>gh pr edit --body-file <file>
- Use
--body-file -only when stdin is clearly available and intentional.
Good:
cat > /tmp/comment.md <<'EOF'
## Summary
Detailed markdown with quotes, backticks, and newlines.
EOF
gh issue comment 123 --repo owner/repo --body-file /tmp/comment.md
Bad:
gh issue comment 123 --repo owner/repo --body "## Summary
Detailed markdown with quotes, backticks, and newlines."
Raw JSON payloads
- Prefer
gh api --input <file>for complex request bodies. - When passing many scalar fields, prefer repeated
-f key=valueflags over hand-built shell strings.
Common Recipes
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 138 lines · 22 tokens per session scan A 1fbc40b1a358
ghx is a skill published in the GitHub repository holon-run/holon (134 stars, last pushed today), licensed Apache-2.0. It adds 22 tokens to every session and 1,001 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
google-workspace-setup
One-time setup for gws: install, OAuth, scopes, auto-approve.
dashclaw-ship
The single command that gets a DashClaw change ON MAIN AND LIVE — it resolves everything blocking production, never defers, and never hands back a checklist. Lands feature branches on main (rebase, gate, merge, push so Vercel deploys), bumps the unified platform+SDK version, and realigns every description of the…
google-calendar
Google Calendar via gws: list events, create, accept, find free time.
attachments
Move bytes between Gini upload space, external URLs, and workspace files. Used by every attachment / file-upload / file-download flow regardless of the target system (Linear, GitHub, S3, Notion, etc.).
gini-bug-report
File a locally-captured, already-redacted Gini crash report as a GitHub issue, with the user's consent. Reads the pending crash queue and delegates the actual filing to the github-issues skill.
google-docs
Google Docs via gws: read, append text, structured batch edits.