Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kouroshez/coding-os --skill linux-sysadmingit clone --depth 1 https://github.com/kouroshez/coding-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kouroshez/coding-os/linux-sysadmin)<a href="https://agentmods.dev/skills/kouroshez/coding-os/linux-sysadmin"><img src="https://agentmods.dev/badge/skills/kouroshez/coding-os/linux-sysadmin/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kouroshez/coding-os/linux-sysadmin"><img src="https://agentmods.dev/badge/skills/kouroshez/coding-os/linux-sysadmin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00171 | $0.01550 |
| Opus 5.5 | $0.00068 | $0.00620 |
| Sonnet 5.5 | $0.00034 | $0.00310 |
| Haiku 4.5 | $0.00017 | $0.00155 |
Grade B, and why
linux-sysadmin scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- `curl … | sudo bash` from an unverified source → read it first. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- `curl … | sudo bash` from an unverified source → read it first. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `curl … | sudo bash` from an unverified source → read it first. How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Linux System Administration
A server is a contract with production: it stays up, it's reachable only how you intend, and when it misbehaves you can see why in one pass. This skill is host-level operation + hardening. Containers and pipelines belong to deployment-cicd; the incident process to incident-response; this is the box itself.
Triage a host in one compact report (disk, mem, load, failed units, ports):
bash scripts/triage.sh --json
SSH — the front door, hardened
# /etc/ssh/sshd_config.d/10-hardening.conf (drop-in, survives package upgrades)
PermitRootLogin no
PasswordAuthentication no # keys only — the single biggest win
PubkeyAuthentication yes
KbdInteractiveAuthentication no
MaxAuthTries 3
AllowUsers deploy # allow-list, not everyone
# Wrong — edits the main file, lost on upgrade, no syntax check before reload
vi /etc/ssh/sshd_config && systemctl restart sshd # locks you out if typo'd
# Correct — drop-in + validate + reload (keeps your current session alive)
sshd -t && systemctl reload sshd # -t aborts on bad config
Keys not passwords, root login off, an AllowUsers allow-list, fail2ban for brute-force. Never restart sshd before sshd -t passes — a typo + restart locks you out of a remote box. Full hardening → references/ssh-hardening.md.
systemd — services that restart themselves
# /etc/systemd/system/api.service
[Unit]
Description=API service
After=network-online.target
[Service]
ExecStart=/usr/local/bin/api --port 8080
Restart=on-failure
RestartSec=2
User=api # never run a service as root
NoNewPrivileges=true # cheap hardening
ProtectSystem=strict # read-only /usr, /boot, /etc
[Install]
WantedBy=multi-user.target
systemctl daemon-reload after editing a unit, then enable --now. Read failures with systemctl status api + journalctl -u api -e --no-pager. A service with no Restart= dies silently on the first crash. Recipes → references/systemd-and-services.md.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 116 lines · 171 tokens per session scan B 33c637b3c09c
linux-sysadmin is a skill published in the GitHub repository kouroshez/coding-os (6 stars, last pushed 4d ago), licensed Apache-2.0. It adds 171 tokens to every session and 1,550 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it B with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
run-wenlan
Build, launch, and stop the wenlan daemon (wenlan-server) for local dev and verification. Use when asked to run or restart the daemon, or before driving any surface (HTTP, CLI, MCP) against a live instance.
kv-cache-latency-budgeter
Budget a specialist model fleet against the two production bottlenecks: KV-cache-bound concurrency and end-to-end latency. Computes how many concurrent users a GPU can host (peak KV per active user, not model size, is the binding constraint), proves that quantizing weights does not move that ceiling while KV…
booboo-deploy
Stand up a Booboo brain end to end — scaffold the project, write booboo.config.yaml against a real Postgres/Supabase or JSON source, build the snapshot, then wire the REST API, the MCP server, the 3D viewer and the panel. Use when someone wants a brain built for the first time, wants to point Booboo at their own…
api-workers
Cloudflare Workers deployment using createWorkerHandler from @cyanheads/mcp-ts-core/worker. Covers the full handler signature, binding types, CloudflareBindings extensibility, runtime compatibility guards, and wrangler.toml requirements.
gke-reliability
Improves GKE workload reliability, using PDBs, health probes, and topology spread constraints. Use when configuring GKE workload reliability, setting up PDBs, or configuring GKE health probes (liveness, readiness, startup). Don't use for generating K8s YAML manifests (use gke-manifest-generation) or disaster recovery…
gke-workload-security
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (auditcluster.sh), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (gVisor), enforcing Pod…