Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kimmingul/xllm/execnpx skills add kimmingul/xllm --skill execgit clone --depth 1 https://github.com/kimmingul/xllmWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00099 | $0.00714 |
| Opus 5 | $0.00049 | $0.00357 |
| Sonnet 5 | $0.00020 | $0.00143 |
| Haiku 4.5 | $0.00010 | $0.00071 |
Grade A, and why
exec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
exec — Isolated cross-vendor executor (xllm)
The executor works in an ephemeral local clone — the user's checkout,
branches, index, and config remain read-only territory it can never reach.
Deliverable: refs/xllm/exec/<id> fetched into the main repo + a .patch +
a test-evidence artifact. Merge, push, and credentials stay with the host.
Resolve the script
Claude Code: "${CLAUDE_PLUGIN_ROOT}/scripts/xllm-exec.js".
Other hosts: <plugin-root>/scripts/xllm-exec.js (two directories above this
SKILL.md).
Run (Bash tool)
node <xllm-exec.js> run codex@high "<bounded task>" --test-cmd "npm test"
node <xllm-exec.js> list
node <xllm-exec.js> cleanup <id>|--all
- Give a bounded, self-contained task — the executor sees only the clone,
not this conversation. Include the verification command whenever possible;
without
--test-cmdthe evidence is executor claims only. - Capable providers only (codex; claude when not the host). Unsandboxed CLIs (gemini/grok/cursor) and pure text models (ollama) are refused — they cannot execute safely.
- Same-vendor nesting refused (no codex executor inside Codex).
- If the OS sandbox is unavailable on this machine, exec fails closed;
only re-run with
--sandbox-mode bypassafter telling the user it means clone-level isolation (workflow isolation, not an OS security boundary).
Handback flow (host-side, after exit)
- Read the evidence artifact (last stdout line) — check
Status(green / not-green / no-change / timeout) andMain repo integrity. - Review:
git diff <base>..refs/xllm/exec/<id> - Merge only after review:
git merge --no-ff refs/xllm/exec/<id>(or cherry-pick /git applythe .patch). - Re-run your own verification after merging — executor-green is evidence, not trust.
node <xllm-exec.js> cleanup <id>when done.
Failures are honest: not-green still hands back the branch with failing evidence; never present it as success.
When NOT to use
- Multi-task orchestration, loops, teams → host-native agents compose multiple exec calls; xllm deliberately ships only this one primitive.
- Same-vendor parallel work → host-native subagents.
- Opinion or review only →
ask/review roles. A static small change →propose.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 64 lines · 99 tokens per session scan A acd0023b14e6
exec is a skill published in the GitHub repository kimmingul/xllm (2 stars, last pushed 9d ago), licensed MIT. It adds 99 tokens to every session and 714 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
frappe-payments
Frappe Payments and ERPNext payment workflow guidance for payment gateways, payment requests, subscriptions, invoices, reconciliation, webhooks, and secure checkout flows. Use when work touches payments in Frappe or ERPNext.
magento2-frontend-dev
This skill should be used when the user asks to "create a Knockout.js component", "add a UI Component", "modify layout XML", "customize a template", "write LESS CSS", "style with the Magento UI library", "add a RequireJS module", "extend JavaScript", "customize checkout", or "modify the cart page". Covers Magento 2…
magento2-security-scan
This skill should be used when the user asks to "run a security audit", "find vulnerabilities", "check for XSS", "check CSRF protection", "validate form security", "run a dependency audit", "check for outdated packages", "run a PCI compliance check", or "do a security review before deploy". Scans Magento 2 code for…
review-in-worktree
Use this skill when reviewing code isolated in a Git worktree outside a Govard-managed project directory (for example Maestro merge-request review trees under /tmp), when "govard tool" cannot find the project configuration, or when asked to run Govard-managed commands against a detached review tree.
platform-device-compatibility-matrix
Use when a game needs a platform and device compatibility matrix across OS, hardware, GPU, memory, resolution, input, network, storefront, certification, test evidence, and support policy; not for store metadata preparation.
store-submission-checklist
Use when preparing a game for Steam, console, mobile, or other storefront submission with platform metadata, compliance, ratings, privacy, package, entitlement, and approval requirements.