Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/isaiascope/ai/iso-pushnpx skills add IsaiaScope/ai --skill iso-pushgit clone --depth 1 https://github.com/IsaiaScope/aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/isaiascope/ai/iso-push)<a href="https://agentmods.dev/skills/isaiascope/ai/iso-push"><img src="https://agentmods.dev/badge/skills/isaiascope/ai/iso-push.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.08840 |
| Opus 5 | $0.00059 | $0.04420 |
| Sonnet 5 | $0.00024 | $0.01768 |
| Haiku 4.5 | $0.00012 | $0.00884 |
Grade A, and why
iso-push scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 710 lines — stays where its author put it; the contents beside it link to each section on GitHub.
iso-push
Push what is committed, open a PR a person can read, and promote it through the environment branches — leaving a single linear history and rewriting nothing that has been published without asking first.
Invocation: /iso-push [--pr] [--cascade test|prod] [--no-merge] [--stay].
| flag | effect |
|---|---|
| (none) | push the current branch, nothing else |
--pr |
push, then open a PR against dev and integrate it once CI is green |
--cascade test |
release, then promote dev → test |
--cascade prod |
release, then promote dev → test → prod |
--no-merge |
open the PRs and stop; integrate nothing |
--stay |
stay on the feature branch after a landing instead of returning to the base |
--cascade works with or without --pr. Without it, dev is promoted exactly
as it currently stands.
A pure cascade — --cascade with no --pr — runs from the base, not from a
feature branch. It has no branch to land: it reads only origin/* refs and
promotes dev as it is. That is also where step 8 leaves you at the end of the
previous run, so the two compose. With --pr the opposite holds — there is a
branch to land, and dev cannot open a PR into itself.
| you are on | --cascade |
--cascade --pr |
|---|---|---|
dev / develop |
✅ the right place | ❌ refused, or rescued¹ |
| a feature branch | ❌ refused, "add --pr" |
✅ the right place |
test / prod |
❌ refused, or rescued¹ | ❌ refused, or rescued¹ |
¹ A protected branch carrying its own commits is rescued, not refused.
A commit made while standing on dev, test or prod is stranded: iso-push
cannot push those branches, and a cascade promotes origin/* and so never sees
it. The only way out used to be a hand-typed git reset --hard at the end of a
working session, which is the worst possible moment to improvise one.
So preflight names a branch after the work, moves the commits onto it, resets
the protected branch back to its remote, and leaves you on the new branch. The
run then continues normally — preflight echoes the new branch, so every
later step sees it.
The name comes from the oldest commit above the base, read as a conventional subject — the one that started the work, not whatever you happened to commit last:
| subject | branch |
|---|---|
feat(wiki)!: add note and supersede, delete destroys bytes |
feat/wiki-add-note-and-supersede-delete-destroys |
fix: reject tokens with a future iat |
fix/reject-tokens-with-a-future-iat |
random subject with no type at all |
chore/random-subject-with-no-type-at-all |
An unrecognised type becomes chore/, which is what the version bump would
treat it as anyway — the branch name agrees with what the release will do
rather than guessing something prettier. The slug is cut at a word boundary at
48 characters, never mid-word.
On test or prod this is also the documented remedy for an environment
defect: the stray commit lands on a feature branch whose base is dev, which
is exactly where step 1 says to get it.
Two states are still refused:
- Dirty tree. The move ends in
git reset --hard, which would discard uncommitted work. Commit or stash first. - The target branch already exists. Check it out and merge, or rename it.
The branch is created before the reset, so every commit is reachable from a second ref before anything moves. A failure between the two steps loses nothing.
A protected branch with no commits of its own is refused exactly as before — there is nothing to move, and the invocation is simply wrong.
After anything lands, you end up on the base. A merged feature branch is a
dead lane — GitHub will never move it again, so a commit made there starts a
second head and git pull fetches a ref frozen at the merge. --stay keeps you
on it, for the case where the branch is a base for follow-up work you are about
to push again.
Mechanics live in skills/iso-push/scripts/push.sh. Run it by absolute path.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 710 lines · 118 tokens per session scan A b2c6c9a63db0
iso-push is a skill published in the GitHub repository IsaiaScope/ai (2 stars, last pushed 2d ago), licensed MIT. It adds 118 tokens to every session and 8,840 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-architecture-planner
Use when designing an autonomous agent, planning agent architecture, building a scheduled automation, or creating a Claude Code agent workflow. Triggers: 'design an agent', 'build an automation', 'agent architecture', 'automate this workflow', 'create a scheduled agent', 'shell script agent'.
agent-curator
Deep curation of a single agent definition through structured human conversation. Coordinates knowledge research, persona refinement, tooling optimization, and instruction quality improvement. One agent at a time, with due care.
remotion-upgrade
Upgrade Remotion, and related packages.
release-archivist
Close out a spec-superflow change with verification, summary, and archive readiness. Invoke when implementation is complete, verification is underway, or the user asks for a final wrap-up.
remotion-docs
Search and fetch Remotion documentation pages.
agent-browser
Agent-browser usage guide. Read this before running any agent-browser commands. Covers the snapshot-and-ref workflow, navigating pages, interacting with elements (click, fill, type, select), extracting text and data, taking screenshots, managing tabs, handling forms and auth, waiting for content, running multiple…