Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add itsmostafa/qi --skill qi-cligit clone --depth 1 https://github.com/itsmostafa/qiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/itsmostafa/qi/qi-cli)<a href="https://agentmods.dev/skills/itsmostafa/qi/qi-cli"><img src="https://agentmods.dev/badge/skills/itsmostafa/qi/qi-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/itsmostafa/qi/qi-cli"><img src="https://agentmods.dev/badge/skills/itsmostafa/qi/qi-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 11 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 180 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 263 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02785 |
| Opus 5.5 | $0.00035 | $0.01114 |
| Sonnet 5.5 | $0.00018 | $0.00557 |
| Haiku 4.5 | $0.00009 | $0.00279 |
Grade A, and why
qi-cli scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://localhost:11434/v1/embeddings -H "Content-Type: application/json" \ How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
qi is a local-first knowledge search CLI. It indexes documents into SQLite and supports BM25 full-text search and vector/hybrid search (with a local or remote embedding provider).
Quick Start
qi init # Create config + database
$EDITOR ~/.config/qi/config.yaml # Add collections and (optionally) providers
qi index # Index the current directory, or a collection
qi doctor # Verify setup
qi search "your query" # BM25 keyword search (no provider needed)
qi query "your semantic question" # Hybrid search (needs embedding provider)
Commands
qi init
Writes ~/.config/qi/config.yaml (if absent) and initializes the SQLite database.
qi init
qi index [path|collection]
Indexes documents. SHA-256 content hashing means unchanged files are skipped. Embeddings are generated at index time — if you add an embedding provider to config after an initial index run, re-run qi index to populate the missing embeddings.
qi index # indexes current working directory
qi index ~/notes # any absolute or relative path
qi index notes # generated collection name from config
qi search <query>
BM25 full-text search. Fast, offline, no provider needed.
qi search "authentication"
qi search "deploy" -c wiki -n 5
qi query <query>
Semantic/hybrid search. Falls back gracefully to BM25 if the embedding provider is unavailable.
qi query "how does auth work"
qi query "deploy pipeline" --mode lexical # BM25 only
qi query "deployment steps" --mode hybrid # BM25 + vector (default)
qi query "critical path" --mode deep # alias for hybrid
qi query "question" --explain # show BM25/vector/RRF score breakdown
Modes:
lexical— BM25 onlyhybrid— BM25 + vector fused with RRF; skips vector if BM25 has a clear winnerdeep— alias forhybrid
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed · +8 lines 561bfa92899b
- 1mo ago Changed · +20 lines b57a1eb5db18
- 1mo ago Changed · +11 lines · -27 tokens per session a8371a35bab1
- 1mo ago Changed · -44 lines · -10 tokens per session a9b59a126f2a
- 1mo ago First seen · 308 lines · 125 tokens per session scan A 0dd3ca209dc7
qi-cli is a skill published in the GitHub repository itsmostafa/qi (44 stars, last pushed 23d ago), licensed MIT. It adds 88 tokens to every session and 2,785 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wegent-knowledge
Knowledge base management and search tools for Wegent. Provides capabilities to list, create, update, and search knowledge bases and documents using RAG retrieval. Use this skill when the user wants to manage knowledge bases, documents, or search for information programmatically.
llm-wiki
Explain and apply the foundational LLM Wiki architecture and knowledge-management strategy. Use for setup, architecture, schema, or organization decisions; operational ingest/query/lint work uses dedicated skills.
llmwiki
Build and use a persistent, citation-traceable knowledge wiki from documents, research papers, notes, or project documentation. Use for llmwiki projects, retrieving reusable evidence for an agent task, or compiling a corpus for repeated questions. A one-off file read or live web search does not need a wiki.
karpathy-llm-wiki
Use when building or maintaining a personal LLM-powered knowledge base. Triggers: ingesting sources into a wiki, querying wiki knowledge, linting wiki quality, 'add to wiki', 'what do I know about', or any mention of 'LLM wiki' or 'Karpathy wiki'.
retrieval-workflow
Retrieve ranked evidence bundles from the published DocMason knowledge base.
ingest
Populate the gnosis-mcp knowledge base — from local files, git history, or a crawled website. Handles the full matrix of flags (--force, --prune, --wipe, --embed, --include-crawled) in one place.