Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lance0/nbox/tag-writesnpx skills add lance0/nbox --skill tag-writesgit clone --depth 1 https://github.com/lance0/nboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lance0/nbox/tag-writes)<a href="https://agentmods.dev/skills/lance0/nbox/tag-writes"><img src="https://agentmods.dev/badge/skills/lance0/nbox/tag-writes.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00055 | $0.00612 |
| Opus 5 | $0.00028 | $0.00306 |
| Sonnet 5 | $0.00011 | $0.00122 |
| Haiku 4.5 | $0.00006 | $0.00061 |
Grade A, and why
nbox-tag-writes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
nbox tag writes
Two update write commands manage tags on any taggable NetBox object,
sharing one planner/applier (TagOperation::Add/Remove). Both follow the
same dry-run / confirm / audit lifecycle (see the
safe writes skill).
The two tag commands
nbox tag add <type> <name> <tag>
Add a tag to any taggable object.
nbox --no-tui tag add device edge01 prod --dry-run --json
nbox --no-tui tag add device edge01 prod --allow-writes --confirm --json
nbox tag remove <type> <name> <tag>
Remove a tag from any taggable object.
nbox --no-tui tag remove device edge01 prod --dry-run --json
nbox --no-tui tag remove device edge01 prod --allow-writes --confirm --json
Optional: --message. Run nbox tag add --help / nbox tag remove --help
for the full flag set.
How it works
<type>is any read kind: device, ip, prefix, vlan, site, rack, circuit, vm, cluster, vrf, … — anything that carries atagsarray.<name>is the object's reference (name, slug, address, CIDR, id — same resolver asnbox <kind> <ref>).<tag>resolves by id, exact name, or exact slug (same resolver asnbox tagged).- NetBox
PATCHreplaces the wholetagsarray, so the plan carries the full replacement slug list. The before/after diff shows the tag slugs. - A no-op (adding a tag the object already carries, or removing one it
doesn't) sends no
PATCH— the receipt reportsno_op: true. - Concurrency: ETag + If-Match on NetBox 4.6+;
last_updated+ before-hash on pre-4.6. A concurrent writer is caught and the write is refused with a "re-run dry-run" message (exit 1).
Reference
- Safe writes skill — the universal lifecycle
- ADR-0001 — foundation design
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 56 lines · 55 tokens per session scan A 06439e22698c
nbox-tag-writes is a skill published in the GitHub repository lance0/nbox (11 stars, last pushed 22d ago), licensed Apache-2.0. It adds 55 tokens to every session and 612 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
generic-resource-actions
Shared CRUD pattern for NetBox resources whose entire CLI surface is generated from the OpenAPI schema.
dcim-devices
NetBox DCIM device CRUD with foreign-key name resolution and bulk operations.
dcim-interfaces
NetBox DCIM interface CRUD with composite addressing, VLAN/LAG name resolution, and cable trace.
ipam-prefixes
NetBox IPAM prefix CRUD plus available-ips and available-prefixes allocation helpers.
config
Manage nbx NetBox URL, token, and named contexts in /.config/nbx/config.toml.
preflight
Verify NetBox reachability and token authentication before running mutations.