Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HybridAIOne/hybridclaw --skill gh-issuesgit clone --depth 1 https://github.com/HybridAIOne/hybridclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hybridaione/hybridclaw/gh-issues)<a href="https://agentmods.dev/skills/hybridaione/hybridclaw/gh-issues"><img src="https://agentmods.dev/badge/skills/hybridaione/hybridclaw/gh-issues/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hybridaione/hybridclaw/gh-issues"><img src="https://agentmods.dev/badge/skills/hybridaione/hybridclaw/gh-issues.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 148 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 258 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 275 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.04666 |
| Opus 5 | $0.00039 | $0.02333 |
| Sonnet 5 | $0.00016 | $0.00933 |
| Haiku 4.5 | $0.00008 | $0.00467 |
Grade A, and why
gh-issues scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
do not echo tokens, and do not use `curl` for authenticated GitHub API calls. If How it starts
The opening of the file, as written. The whole thing — 543 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Issues
You are an issue queue orchestrator. Follow the phases in order. Do not run processing preflight before the user has selected issues.
Live data invariant: every issue-list or "no issues matched" response must be based on a successful GitHub data tool call made in the current turn. Never reuse issue tables, issue numbers, labels, or "no matches" results from memory, conversation history, session search, cached summaries, or previous turns. If no current-turn GitHub data call succeeds, report the fetch failure instead of answering from stale context.
Use this skill for /gh-issues requests that start from a GitHub issue list,
batch issue filters, fix/issue-* branch automation, issue-fix PR review
monitoring, or scheduled issue queue follow-up.
Do not use this skill for ordinary branch, commit, push, PR, CI, or review work that starts from the current branch or a known PR. Use a GitHub PR workflow or code-review skill for those.
Phase 1 - Parse Arguments
Parse the arguments after /gh-issues.
Positional:
owner/repo: source repository. If omitted, infer it fromgit remote get-url origin; if that is unavailable, ask forowner/repo. Ifowner/repois provided explicitly, do not run any local git discovery during parsing or issue listing. Local checkout checks belong only to Phase 4 after issue selection.
Flags:
| Flag | Default | Description |
|---|---|---|
--label <label> |
none | Filter by label. |
--limit <n> |
10 |
Max issues to fetch per poll. |
--milestone <milestone> |
none | Filter by milestone title. |
--assignee <assignee> |
none | Filter by assignee; resolve @me with gh api user --jq .login. |
--state <open|closed|all> |
open |
Issue state. |
--fork <owner/repo> |
none | Push branches to a fork while PRs target the source repo. |
--watch |
false | Fetch the issue list normally, then schedule recurring issue and review follow-up after the first confirmed run. |
--interval <minutes> |
5 |
Watch interval; only valid with --watch. |
--cron |
false | Recurring-run mode: process at most one eligible item and exit. |
--dry-run |
false | Fetch and display issues only. |
--yes |
false | Process listed issues without another confirmation. |
--reviews-only |
false | Skip issue fetching and process issue-fix PR review feedback. |
--model <model> |
none | Optional model override for delegated tasks. |
--notify-channel <target> |
none | Optional HybridClaw message target for final summaries only. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 543 lines · 78 tokens per session scan A 5b6871d00140
gh-issues is a skill published in the GitHub repository HybridAIOne/hybridclaw (132 stars, last pushed yesterday), licensed MIT. It adds 78 tokens to every session and 4,666 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rag-code-review
When performing code review on a PR, diff, snippet, or "look at this change" request, first consult the corpus for related ADRs, coding standards, prior patterns, and similar files. Grounds review comments in the team's actual decisions instead of generic best practices. Trigger on any review-style request — "review"…
m3-notify
Poll the inbox for new notifications addressed to you.
flashcard-generator
Generate educational flashcards from topics, documents, notes, or study materials. Produces structured JSON data and can create polished Tailwind CSS HTML flashcard review pages with interactive card flipping, progress, tags, and difficulty labels.
memory-to-skill
Turn workflows from your MemSearch memory into reusable skills. Use when the user asks to make/create/extract/distill a skill from what they just did or from past work, review skill candidates, install a distilled skill, or 'turn this into a skill'. Manages MemSearch procedural-memory candidates under…
qqexmail
An email skill for Tencent Enterprise Email, a business email service, using the standard IMAP and SMTP protocols to read and send messages.
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.