Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add igmarin/rails-agent-skills --skill setupgit clone --depth 1 https://github.com/igmarin/rails-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/igmarin/rails-agent-skills/setup)<a href="https://agentmods.dev/skills/igmarin/rails-agent-skills/setup"><img src="https://agentmods.dev/badge/skills/igmarin/rails-agent-skills/setup.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 37 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 45 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.01470 |
| Opus 5 | $0.00017 | $0.00735 |
| Sonnet 5 | $0.00007 | $0.00294 |
| Haiku 4.5 | $0.00003 | $0.00147 |
Grade A, and why
setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Persona
Agent Phases
Phase 1: Context & Onboarding
Inline setup (always applicable):
# Verify Ruby version matches .ruby-version
ruby -v
# Install dependencies
bundle install
# Check database connectivity
rails db:create db:migrate
# Confirm test runner is operational
bundle exec rspec --dry-run
# Load env vars (copy example if missing)
cp .env.example .env 2>/dev/null || true
HARD GATE — Environment Check (all items must pass before Phase 2):
- Ruby version correct (check
.ruby-version) - Bundler installed and working
- Database connection successful
- Runtime env vars are available from the shell or
.env - Encrypted secrets are configured in
config/credentials.yml.enc -
config/master.keyexists (orRAILS_MASTER_KEYenv var is set) - All external CI actions pinned to immutable commit SHAs (never mutable tags like @v4, @v1)
If environment check FAILS: Fix the failing item above before proceeding to Phase 2.
Phase 2: CI/CD Configuration
Proceed only after environment check passes.
Canonical shared job preamble (SHARED_PREAMBLE — paste verbatim at the start of every job's steps; both ci.yml and cd.yml use this block):
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
- uses: ruby/setup-ruby@ff740bc00a01b3a50fffc55a1071b1060eeae9dc
with:
ruby-version: .ruby-version
bundler-cache: true
Tip: If your repository uses a
templates/directory, you may save the finalci.ymlandcd.ymlcontent there for reuse across projects. The instructions below are the canonical source of truth.
-
Configure CI pipeline — write to
.github/workflows/ci.yml.Start each job with
SHARED_PREAMBLE, then add:
- run: bundle exec rails db:create db:migrate
- run: bundle exec rspec
- run: bundle exec rubocop
- run: bundle exec brakeman --no-pager
- run: bundle exec bundle-audit check --update
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 175 lines · 35 tokens per session scan A 5bc03eb82720
setup is a skill published in the GitHub repository igmarin/rails-agent-skills (24 stars, last pushed 17d ago), licensed MIT. It adds 35 tokens to every session and 1,470 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
azure-functions
Expert knowledge for Azure Functions development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when wiring Functions to triggers/bindings, Cosmos/SQL/Service Bus, VNet/private…
insforge-cli
Use this skill whenever someone needs a backend, or a task touches InsForge backend or cloud infrastructure through the InsForge CLI: projects, SQL, migrations, RLS policies, functions, storage, backups, deployments, compute, secrets, config, schedules, logs, diagnostics, advisor scans and suppressions, import/export…
aws-solution-architect
Design AWS serverless architectures for startups with IaC. Use when designing serverless architecture, writing CloudFormation, optimizing AWS costs, setting up CI/CD, or migrating to AWS across Lambda, API Gateway, and DynamoDB.
aws-serverless-patterns
AWS Lambda + API Gateway + Step Functions + EventBridge + SQS/SNS patterns. Cold-start mitigation, async webhook backpressure, idempotency, fan-out via SNS topics, retry/DLQ design, and Serverless Framework / SAM / CDK conventions. Auto-fires for serverless.yml, template.yaml (SAM), and handlers/.ts.
aws-serverless
Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools, function URLs, EventBridge Scheduler, Lambda…
azure-cloud-architect
Design Azure architectures with Bicep IaC templates, cost optimization, and CI/CD pipelines for App Service, AKS, Functions, Cosmos DB, and Azure SQL.