worker-setup

An onboarding workflow for setting up external coding workers, such as Codex, Gemini, Grok, and Kiro, one at a time.

In plain words
What is it for?
Use it to inspect worker availability, install missing tools, authenticate each worker, and verify that its connection works.
Why use it?
It avoids trying to use a worker before its command, login, or connection is ready, while explaining possible costs before installation or paid checks.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/joymin5655/agent/worker-setup
Any agent
npx skills add joymin5655/Agent --skill worker-setup
Clone the repo
git clone --depth 1 https://github.com/joymin5655/Agent

Made for: Claude Code, Codex.

Per session 85 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,650 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00085 $0.02650
Opus 5 $0.00043 $0.01325
Sonnet 5 $0.00017 $0.00530
Haiku 4.5 $0.00009 $0.00265

Measured 2d ago against content hash c2263100ccbc, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

worker-setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

macOS. Shell installer (`curl -fsSL https://chatgpt.com/codex/install.sh | sh`)

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

| config seeded | codex: `~/.codex/config.toml` exists; gemini/antigravity: `~/.gemini/antigravity-cli/agent-tiers.json`; grok: `~/.grok/agent-tiers.json`; kiro-*: at least one `~/.kiro/agents/*.json` matching a `--agent

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

macOS. Shell installer (`curl -fsSL https://chatgpt.com/codex/install.sh | sh`)
skills/worker-setup/SKILL.md · 198 lines

How it starts

The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/worker-setup

Goal

Onboard the cross-vendor worker lanes (core/infra/backends.json) one at a time: install → authenticate → verify, with an honest cost/allocation briefing up front. This skill never dispatches a review or a completion check itself — that is core/infra/call-worker.sh, consumed by /council-review and /verify-completion --second-opinion. This skill only gets a lane from absent to healthy.

Step 0 — resolve the harness root

HR="${CLAUDE_PLUGIN_ROOT:-$PWD}"
test -f "$HR/core/infra/backends.json" || echo "worker-setup: backends registry not found at $HR — plugin users: reinstall the plugin; repo users: run this from the repo root" >&2

Stop here with that guidance if the registry does not resolve. Every command below is relative to $HR.

Step 1 — read-only status sweep (zero paid calls)

Read $HR/core/infra/backends.json live with jq — never hardcode the lane list, the registry is the source of truth and can grow lanes this skill has never seen. For every backend, report one row:

Column How to get it
lane the backend's key in .backends
vendor .backends[$lane].vendor
cmd on PATH command -v on .backends[$lane].cmd[0]
preflight on PATH command -v on .backends[$lane].preflight[0]
config seeded codex: ~/.codex/config.toml exists; gemini/antigravity: ~/.gemini/antigravity-cli/agent-tiers.json; grok: ~/.grok/agent-tiers.json; kiro-*: at least one ~/.kiro/agents/*.json matching a --agent in that lane's tier_args
cost model from step 2's table
tiers keys of .backends[$lane].tier_args
roles served reverse-lookup: which .roles[*].backend (or .fallback) names this lane

Also check once, separately: is $HOME/bin on PATH (workers/preflights resolve from there — setup.sh's ensure_home_bin/doctor row).

This step makes zero network calls and zero CLI invocations beyond command -v — it is safe to run unconditionally, including before the user has decided anything.

Read the full file on GitHub · 198 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 198 lines · 0 tokens per session scan D c2263100ccbc

Subscribe to this mod's changes

worker-setup is a skill published in the GitHub repository joymin5655/Agent (2 stars, last pushed 7d ago), licensed MIT. It adds 85 tokens to every session and 2,650 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

regex-mastery

Use this skill when writing regular expressions, debugging pattern matching,optimizing regex performance, or implementing text validation. Triggers on regex, regular expressions, pattern matching, lookahead, lookbehind, named groups, capture groups, backreferences, and any task requiring text pattern matching.

alibaba/anolisa · 60 tokens

shell-scripting

Use this skill when writing bash or zsh scripts, parsing arguments, handling errors, or automating CLI workflows. Triggers on bash scripting, shell scripts, argument parsing, process substitution, here documents, signal trapping, exit codes, and any task requiring portable shell script development.

alibaba/anolisa · 60 tokens

agent-vitals

Introspect the user's local AI agent infrastructure in real time. Use proactively: before starting tasks, before scheduling cron/timer work, when stuck, after long tasks, or when claiming something works. Exposes tools: vitalssummary, shadowlist, shadowstale, burnoutsummary, burnoutstucksessions.

anirudhprashant/agent-vitals · 68 tokens

agent-reach

MUST USE when user wants to 调研/research/搜索/search/查/找/look up anything on the internet — e.g. 全网调研 X / 帮我调研一下 X / 查一下 X / 搜搜 X / 看看大家怎么评价 X / X 上有什么讨论 / research this topic。 Also MUST USE when user mentions any platform or shares any URL/链接: 小红书/xiaohongshu/xhs, Twitter/推特/X, B站/bilibili, Reddit, Facebook, Instagram…

Panniantong/Agent-Reach · 349 tokens

workflows

Execute a workflow script that orchestrates multiple subagents deterministically. Use when the user explicitly requests a workflow, multi-agent orchestration, parallel or sequential agent pipelines, structured agent outputs, or a durable background workflow run.

get-bb/bb · 47 tokens

memory

Use durable BB memory when prior project knowledge or cross-project user preferences can improve the current task, and save durable new learning through the bb memory CLI.

get-bb/bb · 32 tokens