Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KevinZai/commander --skill ccc-onboardgit clone --depth 1 https://github.com/KevinZai/commanderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevinzai/commander/ccc-onboard)<a href="https://agentmods.dev/skills/kevinzai/commander/ccc-onboard"><img src="https://agentmods.dev/badge/skills/kevinzai/commander/ccc-onboard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevinzai/commander/ccc-onboard"><img src="https://agentmods.dev/badge/skills/kevinzai/commander/ccc-onboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 4 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02059 |
| Opus 5.5 | $0.00025 | $0.00824 |
| Sonnet 5.5 | $0.00012 | $0.00412 |
| Haiku 4.5 | $0.00006 | $0.00206 |
Grade A, and why
ccc-onboard scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
On Codex, AskUserQuestion becomes a plain-text question with the same options, and WebFetch becomes a `curl -sI` reachability check. How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
$ccc-onboard — contributor first hour
CC Commander · $ccc-onboard · role → first task → a verified first hour
Build the guide from the repository's own instructions and scripts, never from a generic open-source checklist. The skill is read-only: it inspects files and tool versions and returns a plan; it installs, edits and commits nothing.
On Codex, AskUserQuestion becomes a plain-text question with the same options, and WebFetch becomes a curl -sI reachability check.
When to use / when not to
- Use when a contributor is new to a repository (any repository, including Commander's own) and needs a practical first hour.
- Use
$ccc-startfor first-run Commander onboarding,$ccc-adoptto add Commander conventions to a project's CLAUDE.md, and$ccc-xrayfor a project health scorecard.
What happens
1. Brand header
**CC Commander** · $ccc-onboard · Contributor first hour
2. Repo context
Read only the files that exist, in this order:
CLAUDE.md— local conventions, required tools, test commands, workflow rulesBIBLE.md— product architecture, domain language, non-negotiable project rulespackage.json— scripts, package manager clues, workspace structureREADME.md— only if the first three do not yield enough starter links
ls CLAUDE.md BIBLE.md package.json README.md 2>/dev/null
git rev-parse --show-toplevel 2>/dev/null
Summarize in one line:
Repo: <name> · package manager: <npm|bun|pnpm|yarn|unknown> · scripts: <top useful scripts> · primary stack: <detected stack>
If none of the four files exist and there is no git root, say so and stop: there is no repo truth to build from.
3. Clone-time validator
Run before writing the checklist. CLAUDE.md is the source of truth for required tool versions; also check the common tools:
node --version
bun --version
npm --version
git --version
gh --version
Package manager clues:
test -f bun.lockb && echo bun
test -f bun.lock && echo bun
test -f pnpm-lock.yaml && echo pnpm
test -f yarn.lock && echo yarn
test -f package-lock.json && echo npm
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · -17 lines · +30 tokens per session fd683cdd7899
- 1mo ago First seen · 223 lines · 32 tokens per session scan A d9a830a2cbf0
ccc-onboard is a skill published in the GitHub repository KevinZai/commander (6 stars, last pushed yesterday), licensed MIT. It adds 62 tokens to every session and 2,059 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
debt-ops-add
Register a deferred decision in the tech-debt registry. Trigger by judgment, not a marker scan, whenever a future reader would ask "why this way?": an unmade decision, stub, loosened type, bypassed check, swallowed error, a default picked "for now", or a TODO/FIXME/HACK/XXX marker. Trigger immediately whenever you…
import
Import a tasks.md into the coco tracker as an epic with dependencies, and create matching issues in the configured issue tracker.
hotfix
Single-issue workflow for quick fixes and small changes that don't need full epic tracking. Creates a branch, implements the fix, commits with issue tracking, and closes.
debt-ops-review
Audit the tech-debt registry, rank survivors by churn × Fowler quadrant, surface a top-N list, then walk paydown on user follow-up. Use when the user asks to review debt, see what to pay down, work through entries, or check the debt registry. Stale entries drop with "drop A,B,C".
loki-mode
Multi-agent autonomous startup system for Claude Code. Triggers on "Loki Mode". Orchestrates 100+ specialized agents across engineering, QA, DevOps, security, data/ML, business operations, marketing, HR, and customer success. Takes PRD to fully deployed, revenue-generating product with zero human intervention.…
hermit-scribe
File a GitHub issue or post a comment on an existing issue via a GitHub App bot identity. Use when the operator says "file as a GH issue", "open an issue for PROP-NNN", "report this to the tracker", "add a comment to issue.