Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add longsizhuo/openInvest --skill invest-backupgit clone --depth 1 https://github.com/longsizhuo/openInvestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/longsizhuo/openinvest/invest-backup)<a href="https://agentmods.dev/skills/longsizhuo/openinvest/invest-backup"><img src="https://agentmods.dev/badge/skills/longsizhuo/openinvest/invest-backup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/longsizhuo/openinvest/invest-backup"><img src="https://agentmods.dev/badge/skills/longsizhuo/openinvest/invest-backup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 4 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00202 | $0.01146 |
| Opus 5 | $0.00101 | $0.00573 |
| Sonnet 5 | $0.00040 | $0.00229 |
| Haiku 4.5 | $0.00020 | $0.00115 |
Grade A, and why
invest-backup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Invest Backup Skill
Why this skill exists
openInvest's real data (holdings/strategy/user profile/committee records under memory/, trade ledger/job history under db/) is entirely .gitignored — deliberately (privacy: it contains real assets/salary/trades), but the price is that git can't help at all. There was an incident on 2026-07-08: a one-off migration script named migrate_profile.py (with no safety guard whatsoever) was run directly once, overwriting user.md / strategy.md / portfolio.md with hard-coded demo defaults; daily_report then exited early every day because target_assets had become empty, emails stopped entirely from that point on, and the user had no idea until they noticed the missing emails and traced it back.
In any of the following scenarios, proactively use this skill:
- Before running any unfamiliar migration / init / bulk script that writes to
memory/ordb/→backupfirst - The user says holdings, strategy, or committee records look wrong / wiped →
backupfirst (even if the current state is already broken, save the "broken state" — otherwise you lose even the diagnostic material), then investigate - Migrating to a new machine / reinstalling the deployment →
backupto package,restoreon the new machine
Usage
plugin/skills/invest-backup/scripts/run.sh backup [output_dir] # defaults to $INVEST_ROOT/.backups/
plugin/skills/invest-backup/scripts/run.sh restore <zip_path> [--force]
plugin/skills/invest-backup/scripts/run.sh list
- backup: packs
memory/,db/*.sqlite,db/*.db,.env,user_profile.json*into a single UTC-timestamped zip. The data directory is resolved viaopeninvest.paths.INVEST_ROOT(same precedence order as the rest of the backend:INVEST_HOMEenv → repo-marker detection → cwd) instead of re-guessing paths in shell. - restore: unpacks a zip back into the data directory. By default it refuses to overwrite a
portfolio.mdthat already contains real holdings/cash (same criterion as the 2026-05-10 incident defense inlifecycle_cmds.py:_write_v2_portfolio: cash > 0 in any currency, or non-empty holdings, counts as real data) — to confirm the overwrite you must explicitly pass--force. With or without--force, the current state is automatically backed up before restoring, so the operation itself is reversible. - list: lists existing backups, newest first, with sizes.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 43 lines · 202 tokens per session scan A 3d78bb201728
invest-backup is a skill published in the GitHub repository longsizhuo/openInvest (83 stars, last pushed yesterday), licensed MIT. It adds 202 tokens to every session and 1,146 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
yield-xyz-agentkit-builder
Build applications that integrate with the Yield.xyz APIs — staking, lending, vaults, and RWA across 80+ networks. Generates code covering REST API integration, transaction signing, wallet connection, and fee monetization. Use when user wants to build an app, integrate yield, generate code, or set up a project using…
yield-xyz-agentkit-privy
The Privy connector for the Yield.xyz AgentKit — signs and broadcasts via Privy agentic wallets. Extends the yield-xyz-agentkit skill — that skill discovers yields and builds the unsigned transactions; this one adds Privy wallet creation, policy enforcement, signing, and broadcasting, in autonomous and semi-autonomous…
yield-xyz-agentkit-moonpay
The MoonPay connector for the Yield.xyz AgentKit — signs and broadcasts via MoonPay. Extends the yield-xyz-agentkit skill — that skill discovers yields and builds the unsigned transactions; this one adds MoonPay wallet auth, signing, and broadcasting. Use when the user wants to enter, exit, or manage yield positions…
yield-xyz-agentkit
Discover and act on 2,900+ DeFi yield opportunities via Yield.xyz AgentKit Skills, find yields, check APY enter/exit positions, and manage rewards across 80+ networks.
comptable
Comptabilité, fiscalité et facturation pour entreprises françaises. Gère écritures PCG, déclarations TVA, IS/IR, clôture annuelle, liasse fiscale (2033/2065), FEC, états financiers, et chaîne facturation (mentions obligatoires, numérotation, Factur-X/UBL/CII, plateformes agréées PDP/PA, e-reporting, réforme 2026…
fiscaliste
Fiscaliste IA pour la fiscalité personnelle des particuliers français : optimisation et déclaration de l'impôt sur le revenu, IFI, revenus du capital, revenus fonciers, equity salarial, crypto-actifs et PER. Couvre le calcul de l'IR (barème, quotient familial, décote, PAS, CEHR, revenus exceptionnels), la déclaration…