Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/madarco/agentbox/agentbox-setupnpx skills add madarco/agentbox --skill agentbox-setupgit clone --depth 1 https://github.com/madarco/agentboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.05712 |
| Opus 5 | $0.00019 | $0.02856 |
| Sonnet 5 | $0.00008 | $0.01142 |
| Haiku 4.5 | $0.00004 | $0.00571 |
Grade B, and why
agentbox-setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt-get update && sudo apt-get install -y postgresql-client How it starts
The opening of the file, as written. The whole thing — 318 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/agentbox-setup
Box layout (what you're configuring against)
Your user i vscode and you can use sudo to run commands as root.
/workspace is where the user code lives, a per-box git worktree on a fresh agentbox/<box-name> branch (or a tar-piped copy of the host workspace for non-git projects).
Run agentbox checkpoint --set-default (similar to docker commit) to save any changes make to the system and workspace so that new boxes will start from a warm state. Everything is wiped on agentbox destroy.
Some special folders:
- Host main repo's
.git/— If the box bind-mounted RW at its identical absolute host path. In-box commits land on the host's branch refs (visible togit logon the host immediately); the box itself carries no SSH/git creds, sogit pushgoes through the host relay (agentbox-ctl git push). The host's working tree is never written to — only refs/objects under.git/. GitHub PR ops (agentbox-ctl git pr create|view|list|comment|review|merge|close|reopen|checkout) flow the same way through hostgh; write ops require host confirmation (deny → exit 10),mergeandcheckouthave additional opt-in guards. ~/.claude— and similar home folders for coding agents are seeded from the host's~/.claudeon each create so auth, skills, and plugins persist without leaking the host's home dir.agentbox.yaml— read byagentbox-ctlfrom/workspace. Tasks and services declared here are what the supervisor will run.
Exposed ports and services:
- portless - every port with
expose:setting in agentbox.yaml, will be exposed not only as a local port but also as a special domain namehttps://<name>.localhost(so on https) usingportlesscli and proxy. This will be also mapped to the host where alsoportlessproxy is running so users can access the same service on the same looking url. - vnc - the webVNC server exposed on 6080 will be proxies to the host on a random port.
- vscode - the vscode server is proxied to the host on a random port.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 318 lines · 38 tokens per session scan B 77dee19c82bb
agentbox-setup is a skill published in the GitHub repository madarco/agentbox (378 stars, last pushed 2d ago), licensed MIT. It adds 38 tokens to every session and 5,712 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
setup
Manual setup of aicontainer (the sandboxed devcontainer for running AI coding agents in bypass/auto-approve mode) in a project.
docker-sandbox
Create, manage, and execute agent tools (claude, codex) inside Docker sandboxes for isolated code execution. Use when running agent loops, spawning tool subprocesses, or any task requiring process isolation. Triggers on "sandbox", "isolated execution", "docker sandbox", "safe agent execution", or when working on agent…
debugging-output-and-previewing-html-using-ray
Use when user says "send to Ray," "show in Ray," "debug in Ray," "log to Ray," "display in Ray," or wants to visualize data, debug output, or show diagrams in the Ray desktop application.
fortify-development
ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), passkeys, profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions…
publish-registry
Publish @agentos-software/ registry packages from AgentOS. Use whenever the user asks to publish or release registry software/agent packages.
songwriting-and-ai-music
Songwriting craft, AI music generation prompts (Suno focus), parody/adaptation techniques, phonetic tricks, and lessons learned. These are tools and ideas, not rules. Break any of them when the art calls for it.