Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kousen/claude-code-training/osquerynpx skills add kousen/claude-code-training --skill osquerygit clone --depth 1 https://github.com/kousen/claude-code-trainingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.00640 |
| Opus 5 | $0.00036 | $0.00320 |
| Sonnet 5 | $0.00015 | $0.00128 |
| Haiku 4.5 | $0.00007 | $0.00064 |
Grade A, and why
osquery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
osquery System Diagnostics
You wrap the osqueryi command-line tool. The user asks diagnostic questions in
plain English; you translate to SQL against osquery's system tables, run the
query, and explain the result.
How to run a query
Always use --json for parseable output:
osqueryi --json "SELECT ... FROM ... WHERE ...;"
Parse the JSON, then summarize in plain English. Don't dump raw JSON at the user unless they ask for it.
Common question → query map
| User asks | Query to run |
|---|---|
| "What's hammering my CPU?" / "Why is my computer slow?" | SELECT pid, name, user_time, system_time FROM processes ORDER BY (user_time + system_time) DESC LIMIT 10; |
| "What's using my memory?" | SELECT pid, name, resident_size FROM processes ORDER BY resident_size DESC LIMIT 10; |
| "What's on the network?" | SELECT pid, local_address, local_port, remote_address, remote_port, state FROM process_open_sockets WHERE state = 'ESTABLISHED' LIMIT 20; |
| "What's my system info?" / "Give me an overview" | SELECT hostname, cpu_brand, physical_memory, hardware_model FROM system_info; |
| "What network interfaces do I have?" | SELECT interface, address, mask FROM interface_addresses WHERE address NOT LIKE '127.%' AND address NOT LIKE 'fe80%'; |
If the user's question doesn't match the table, pick the closest osquery table
(processes, memory_info, system_info, interface_addresses,
process_open_sockets, users, logged_in_users, apps, startup_items)
and write a query against it. The schema is documented at
https://osquery.io/schema.
Interpreting results
resident_sizeis in bytes — convert to MB or GB before showing the user.user_timeandsystem_timeare CPU ticks; rank processes relatively rather than reporting raw numbers.- A few system processes are normally near the top:
kernel_task,WindowServer(macOS),systemd(Linux). Note them, don't alarm. - If a query returns no rows, say so explicitly — don't invent results.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 59 lines · 73 tokens per session scan A 68df443391e1
osquery is a skill published in the GitHub repository kousen/claude-code-training (335 stars, last pushed 5d ago), licensed MIT. It adds 73 tokens to every session and 640 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…