Kiro Crew is a persistent development workspace where agents continue multi-step software work across sessions, schedules, and connected interfaces. Developers use it locally or remotely through a desktop app, web dashboard, CLI, Slack, or Discord, with unattended tasks and recurring jobs. The catalogue contains skills and instructions for working with this workspace.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kirodotdev/KiroCrew --skill babysitgit clone --depth 1 https://github.com/kirodotdev/KiroCrewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kirodotdev/kirocrew/babysit)<a href="https://agentmods.dev/skills/kirodotdev/kirocrew/babysit"><img src="https://agentmods.dev/badge/skills/kirodotdev/kirocrew/babysit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kirodotdev/kirocrew/babysit"><img src="https://agentmods.dev/badge/skills/kirodotdev/kirocrew/babysit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 143 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 372 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 725 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 630 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.04955 |
| Opus 5.5 | $0.00018 | $0.01982 |
| Sonnet 5.5 | $0.00009 | $0.00991 |
| Haiku 4.5 | $0.00005 | $0.00496 |
Grade A, and why
babysit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 365 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Babysit
General-purpose monitoring: this skill works without a Kiro Crew checkout or kirocrew-prepare-pr installed. It owns loop mechanics, not a repository's repair policy. For Kiro Crew PR CI AI comments ONLY, MUST load kirocrew-prepare-pr: Review repair routing before any fix. That procedure requires model-pinned repair subagents; parent self-fixing does not satisfy it. Prepare-pr owns that repo's local reviewers, PR gates, dispositions and publication rules. Do not require it for other work.
Choose one driver
Use a structured monitor only when its typed provider observes every fact needed to decide the objective. Use the finite legacy path for evidence it cannot see. Structured watches support dashboard, Slack, and Discord sessions. On Webex, use the finite legacy path even for a supported pull request.
| Work | Driver |
|---|---|
| User is waiting, total work under 30 minutes | Bounded in-turn wait + poll |
| One supported pull request, readiness decided by typed provider facts | monitor_watch |
| Generic comments/advisory findings, or a required final report or notification | Finite monitor_start with gate=false |
| Act on a schedule, multiple subjects, unsupported ticket or deployment | Finite monitor_start |
| Fresh-session work needing no approval-bound tools | cron_add |
| Post-merge cleanup after verified merge | Script cron, roughly every 5 minutes |
| External system calls back | register_hook |
Never use an agent cron or HEARTBEAT.md to fix and push review findings. Cron
has no owning chat slot's trust and can time out at tool approval while still
recording last_status: ok; heartbeat's allowlist has no shell or push.
Use one session-owned driver, not two watchers.
A gated monitor_start hands its whole pull-request reading, comment and review
bodies included, to the wake judge, so wake_when may name prose. No
judge lane: only an unchanged subject is free.
An installation can set how firmly this table's facts-decided row points at the
structured path. With monitoring.prefer_structured_arming on, monitor_watch is
this gateway's default for a supported pull request and the prompt loop is the
exception; off (the default) the table reads as written. The setting changes what
the two tool descriptions say and refuses neither tool, so the row that matters
never moves: evidence the typed provider cannot see -- generic comments, advisory
findings, a required final report -- is monitor_start with gate=false in
either position. Read the descriptions you were given rather than assuming a
position.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +1 lines 5e219dc607d9
- 14d ago Changed · -1 lines ddaf0e56a866
- 18d ago Changed 7aacd28a5fff
- 22d ago Changed · +2 lines b05abd1d8243
- 28d ago Changed · +12 lines 0786076b1ce5
- 1mo ago Changed · +26 lines 731dcb38b9ce
- 1mo ago Changed · +13 lines 30b0cbff2f30
- 1mo ago Changed · -433 lines · -92 tokens per session 80528ec544f8
- 1mo ago Changed 8c0f878923c6
- 1mo ago First seen · 745 lines · 137 tokens per session scan A 0927438ac52e
babysit is a skill published in the GitHub repository kirodotdev/KiroCrew (4,481 stars, last pushed today), licensed Apache-2.0. It adds 45 tokens to every session and 4,955 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deploying-to-staging-environment
Use when deploying changes to staging across relay, relay-dashboard, and relay-cloud repos - coordinates multi-repo branch syncing using git worktrees, automatically triggers staging deployments via GitHub Actions.
vigilante-create-issue
Help a human author write an implementation-ready GitHub issue that Vigilante can execute reliably.
kano-backlog
Prioritize and refine a GitHub Issues backlog with the Kano model — categorize every open issue as Must-be, Performance, Attractive, Indifferent, or Reverse, apply Kano + priority labels back to GitHub automatically, and recommend the single best next issue to pick up. Use this whenever the user wants to triage…
vigilante-issue-implementation
Implement a GitHub issue end-to-end when Vigilante dispatches work for a watched repository. Use the provided worktree, respect repository instructions, comment on the issue as work progresses, and report failures back to GitHub.
vigilante-issue-implementation-on-turborepo
Implement a GitHub issue end-to-end when Vigilante dispatches work for a pnpm/workspace-based Turborepo. Use the provided worktree, respect repository instructions, comment on the issue as work progresses, and report failures back to GitHub.
vigilante-issue-implementation-on-bazel-monorepo
Implement a GitHub issue end-to-end when Vigilante dispatches work for a Bazel-based monorepo. Use the provided worktree, respect repository instructions, comment on the issue as work progresses, and report failures back to GitHub.