Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Knuckles-Team/systems-manager --skill nic-bond-provisionergit clone --depth 1 https://github.com/Knuckles-Team/systems-managerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/knuckles-team/systems-manager/nic-bond-provisioner)<a href="https://agentmods.dev/skills/knuckles-team/systems-manager/nic-bond-provisioner"><img src="https://agentmods.dev/badge/skills/knuckles-team/systems-manager/nic-bond-provisioner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/knuckles-team/systems-manager/nic-bond-provisioner"><img src="https://agentmods.dev/badge/skills/knuckles-team/systems-manager/nic-bond-provisioner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00148 | $0.01597 |
| Opus 5 | $0.00074 | $0.00798 |
| Sonnet 5 | $0.00030 | $0.00319 |
| Haiku 4.5 | $0.00015 | $0.00160 |
Grade D, and why
nic-bond-provisioner scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
`sudo efibootmgr` then `sudo efibootmgr -o <ubuntu-id>,<fixeddisk-id>`. Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
sudo touch /tmp/bond_ok && sudo rm -rf /root/netplan.bak.* How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NIC Bond Provisioner
Provision an active-backup bond0 on a node's canonical static IP using
systemd-networkd, retiring NetworkManager so there is a single network authority and a
deterministic egress (the kernel egress src = the Docker Swarm VXLAN data-path, so a
drifting egress silently breaks cross-node overlay). Every step has a dead-man
auto-revert so a bad apply self-heals.
This skill is failover + determinism, NOT throughput aggregation. For LACP, upgrade the bond mode later once the switch has port-channels.
When to use / not use
- Use: multi-NIC node with several DHCP NICs and a non-deterministic egress; pinning a node to its canonical IP before a swarm re-init; recovering recurring cross-node overlay drift.
- Skip: single-NIC nodes (already deterministic — bonding adds nothing); LACP/throughput needs; hosts not managed by netplan.
Bundled resources
scripts/apply-bond.sh— applies a bond config at the node's console with a self-tearing dead-man revert. Encodes gotchas #1–#5 ofreferences/recovery.md.scripts/gen-bond-config.sh— emit a site-agnostic bond netplan YAML from--ip+--members.references/recovery.md— gotchas, manual recovery, and the post-rollout swarm re-init. Read it before bonding a swarm manager or when an apply misbehaves.
Procedure
1. Discover the node's NICs and confirm prerequisites
On each target node gather the cabled NICs and the DNS/egress state:
ip -br link | grep -vE '^(lo|docker|veth|br-|vx-|.*gwbridge)' # carrier-up NICs
ip -br addr ; ip route get 1.1.1.1 | head -1 # which IP/NIC is egress
ls -l /etc/resolv.conf ; resolvectl status | grep -i 'DNS Server'
Include only carrier-up NICs as bond members (NO-CARRIER ports stay backup forever).
Confirm /etc/resolv.conf → systemd-resolved stub (gotcha #6) — otherwise retiring NM
breaks DNS; fix that first.
2. Generate the per-node bond config
scripts/gen-bond-config.sh --ip <CANONICAL/8> --members "<nic1 nic2 ...>" \
--primary <nic-holding-canonical> --node <NAME> --out /tmp/bond0-<NAME>.yaml
Default DNS is 10.0.0.199 1.1.1.1 and gateway 10.0.0.1 — override with --dns / --gw.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 108 lines · 148 tokens per session scan D 00a2f135a219
nic-bond-provisioner is a skill published in the GitHub repository Knuckles-Team/systems-manager (3 stars, last pushed 12d ago), licensed MIT. It adds 148 tokens to every session and 1,597 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tailscale-mcp
Secure homelab networking with Tailscale + self-hosted Hermes agents via the mcp-tailscale MCP server.
pilot-leader-election
Elect a coordinator with automatic failover using heartbeat-based leader election. Use this skill when: 1. A swarm needs a single coordinator for decision making 2. You need automatic failover when the current leader fails 3. You want to avoid split-brain with deterministic tie-breaking Do NOT use this skill when: …
pilot-service-agents-infra
Pilot Protocol network infrastructure agents — the directory (list-agents) and feedback (feedback). Use this skill when: 1. Discovering other agents on the pilot overlay (list-agents) 3. Submitting feedback about a service agent (feedback) Do NOT use this skill when: - Data-source queries — this category is…
docker-privesc
Escape Docker containers to host root via 5 techniques.
install-openviking-memory
Install and configure the OpenViking long-term memory plugin for OpenClaw via natural conversation. Once installed, the plugin automatically captures facts from chats and recalls relevant context before each reply (auto-capture + auto-recall, cross-session). Covers prerequisites, install through OpenClaw's plugin…
olares-chart
Olares app packaging and chart authoring via olares-cli chart — port a repo, docker-compose, or generic Helm chart; build/push the image; author, lint, package, and deploy an OlaresManifest; wire storage, middleware, entrances, env, and GPU; edit the chart after diagnosis. Runtime failure diagnosis is olares-doctor…