Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jackchuka/ghpm/ghpm-sharednpx skills add jackchuka/ghpm --skill ghpm-sharedgit clone --depth 1 https://github.com/jackchuka/ghpmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jackchuka/ghpm/ghpm-shared)<a href="https://agentmods.dev/skills/jackchuka/ghpm/ghpm-shared"><img src="https://agentmods.dev/badge/skills/jackchuka/ghpm/ghpm-shared.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.00861 |
| Opus 5 | $0.00013 | $0.00430 |
| Sonnet 5 | $0.00005 | $0.00172 |
| Haiku 4.5 | $0.00003 | $0.00086 |
Grade A, and why
ghpm-shared scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ghpm — Shared Reference
Prerequisites
ghCLI installed and authenticated- Token scopes:
read:project,project - GitHub Projects v2 (not classic projects)
Config Files
All ghpm files live under .ghpm/:
| File | Purpose |
|---|---|
.ghpm/config.json |
Project config (fields, views, repos) |
.ghpm/cache.json |
Cached project items |
.ghpm/sessions/<number>.json |
Active work session per issue |
The entire .ghpm/ directory is gitignored (project-specific).
If .ghpm/config.json is missing, tell the user to run /ghpm-init first and stop.
Startup Sequence
Every skill that reads project data should follow this sequence:
- Read
.ghpm/config.jsonfrom the current directory. If missing, stop with init guidance (above). - Load cache following
references/cache.md. If the cache is stale or missing, automatically re-fetch — no user prompt needed. If the re-fetch fails (network error, rate limit), fall back to the stale cache if available and note the age inline (e.g., "Using cached data from 2 hours ago"). - Check for stale sessions: list
.ghpm/sessions/*.json. For each session file, readstarted_atand compare to now. If a session is older than 24 hours, prompt the user:Found stale session for #<num> "<title>" (started <N> days ago). Wrap up and post journal, or discard?- Wrap up: follow the wrap-up sequence from
ghpm-work(gather git context, post journal, clear session). - Discard: delete the session file silently.
- If the user declines both, leave it and continue — don't block the current skill.
- Wrap up: follow the wrap-up sequence from
Error Handling
- Auth expired (
gh auth statusfails): tell the user to rungh auth loginand stop. - Rate limited (HTTP 403 with rate limit message): tell the user to wait and retry later.
- Network error: if cache exists (even stale), offer to use stale cache as fallback.
- Permission denied (HTTP 403/404 on project): tell the user to check token scopes (
read:project,project).
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 74 lines · 25 tokens per session scan A 236997627390
ghpm-shared is a skill published in the GitHub repository jackchuka/ghpm (20 stars, last pushed 4mo ago), licensed MIT. It adds 25 tokens to every session and 861 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
syndic
Gère un parc de copropriétés en France avec vue portfolio consolidée. Couvre administration, comptabilité (décret 2005, plan comptable copro, 5 annexes), assemblées générales (convocation, PV, notification), appels de fonds, travaux, fournisseurs, recouvrement d'impayés et transition de syndic. Maîtrise les majorités…
decision-map
Maps the unresolved architecture, policy, and scope decisions that must be answered before planning can start: one durable decision ticket per question on the issue tracker, typed and blocker-linked under a parent map, with fog-of-war, out-of-scope, a computed frontier, and one decision resolved per invocation.…
to-issues
Decompose a PRD and/or SPEC into implementable, vertically-sliced Issues with real blocking edges, then create them in your chosen platform (GitHub or Local). Use after /prd (and optionally /prd-to-spec) to turn requirements into agent-ready tickets. Triggers on: create issues, to-issues, 创建issue, 拆解issue, 生成卡片, 创建卡片…
setup-matt-pocock-skills
为本仓库配置工程技能——设置其 issue tracker、分诊标签词汇表和领域文档布局。首次使用其他工程技能前运行一次。.
a11y-remediate
Use to produce a leader-facing remediation proposal from one or more /a11y-audit outputs plus team and product context. Translates audit findings into sprint plans, staffing asks, customer-facing language, compliance rollups, and critical-path analysis. Refuses to fabricate numbers, owners, or commitments beyond the…
gh-issues
Use when creating, searching, updating, or managing GitHub issues via CLI. Triggers: "issue", "create issue", "gh issue", "task tracking", "context", "handoff", "resume task", "session context", "save progress", "active tasks", "in-progress", "my tasks", "open issues". Covers: gh commands, bulk operations, JSON/jq…