Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add magnus919/agent-skills --skill grafanagit clone --depth 1 https://github.com/magnus919/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/magnus919/agent-skills/grafana)<a href="https://agentmods.dev/skills/magnus919/agent-skills/grafana"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/grafana/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/magnus919/agent-skills/grafana"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/grafana.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 21 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00127 | $0.01879 |
| Opus 5 | $0.00063 | $0.00940 |
| Sonnet 5 | $0.00025 | $0.00376 |
| Haiku 4.5 | $0.00013 | $0.00188 |
Grade A, and why
grafana scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl --fail --silent --show-error "$GRAFANA_URL/api/health" How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Grafana Operations
Treat Grafana as a set of versioned, separately authorized resources with explicit owners. Discover the target, resource provenance, and effective routing before proposing a mutation. A healthy server or attractive dashboard is not proof that provisioning, queries, alert evaluation, or notification delivery works.
Operating contract
- Identify Grafana version, edition, deployment mode, organization, folder or namespace, authentication model, and current permission scope before selecting an API or workflow.
- Inventory existing file provisioning, Terraform/provider state, Git Sync, Grafana Operator resources, and API/UI-managed objects. Assign one authoritative owner per resource UID before changing it.
- Confirm the target, scope, and rollback path before acting. Read-only discovery may proceed without confirmation.
- Treat dashboard, folder, data-source, alerting, user/RBAC, plugin, and server-configuration changes as separate authorization scopes.
- Never print, commit, or preserve secret values from service-account tokens, passwords,
secureJsonData, decrypted receiver settings, OAuth secrets, signing keys, SMTP credentials, or webhooks. Preserve supported secure configuration fields through their authorized secret mechanism and record redacted metadata only. - Validate dashboard and alert queries against the real data source when access exists. Otherwise state the offline limitation and do not claim semantic correctness.
- Verify the requested boundary. Server health does not prove dashboard provisioning; rule firing does not prove routing; notification delivery does not prove resolution behavior.
When not to use
Use site-reliability-engineering to define SLIs, SLOs, error budgets, page-worthiness, severity policy, escalation, and incident practice. Use data-source-specific guidance for PromQL, LogQL, TraceQL, Flux, SQL, storage, and backend operation. Use docker-compose, kubernetes, traefik, or platform-engineering for their infrastructure control planes. Use secure-software-engineering for preventive security design and security-audit-methodology for an authorized assessment. This skill owns Grafana product behavior and Grafana-side integration.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 11 KB
- EVIDENCE-LEDGER.md 5.8 KB
- README.md 3.5 KB
- references/alerting-and-routing.md 6.4 KB
- references/api-and-version-discovery.md 4.4 KB
- references/dashboard-engineering.md 5.4 KB
- references/provisioning-and-gitops.md 6.3 KB
- references/security-and-change-control.md 5.9 KB
- references/source-index.md 8.4 KB
- references/troubleshooting.md 5.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 105 lines · 127 tokens per session scan A ed30049b8511
grafana is a skill published in the GitHub repository magnus919/agent-skills (76 stars, last pushed today), licensed MIT. It adds 127 tokens to every session and 1,879 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
routine
Manage CocoRoutine Snowflake task scheduling. Usage: $routine list, $routine schedule --cadence , $routine disable , $routine delete .
terraform-expert
Expert-level Terraform infrastructure as code, modules, state management, and production best practices. Use when the user mentions infrastructure as code, devops, or automation, or when the task involves Terraform Basics, Resource Management, Modules, or State Management.
floom
Create, run, and manage Floom AI workers — cloud automations that run on a schedule or a trigger and report back. Reach for this whenever the user wants something to happen repeatedly or in the background rather than a one-off script: a recurring task, "every day / every hour / every week", "schedule this", "run it on…
bridge-health
Quick health check on the bridge daemon (CEO machine + any exec mirrors). Surfaces heartbeat staleness, version drift, active sessions, and the Phase 1 to Phase 2 adoption gate metrics. Use when the dashboard feels stale, the sync-pill is red, the daemon may have crashed, or before a /push-updates that changes daemon…
control-plane-ops
Operar o control-plane local-first do agents-lab com board canônico, long-runs bounded, handoff/checkpoint, rollout/rollback e espelhos externos sem perder governança.
gandi
Gère les domaines, DNS et emails via l'API Gandi v5. Permet de lister les domaines, consulter/modifier les enregistrements DNS, gérer les boîtes mail et configurer les redirections.