Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add magnus919/agent-skills --skill woodpecker-cigit clone --depth 1 https://github.com/magnus919/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/magnus919/agent-skills/woodpecker-ci)<a href="https://agentmods.dev/skills/magnus919/agent-skills/woodpecker-ci"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/woodpecker-ci/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/magnus919/agent-skills/woodpecker-ci"><img src="https://agentmods.dev/badge/skills/magnus919/agent-skills/woodpecker-ci.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 52 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.02074 |
| Opus 5 | $0.00044 | $0.01037 |
| Sonnet 5 | $0.00017 | $0.00415 |
| Haiku 4.5 | $0.00009 | $0.00207 |
Grade A, and why
woodpecker-ci scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Woodpecker CI
Use this skill as an operating playbook, not as a substitute for checking the documentation for the installed major version. Prefer explicit SemVer image tags, verify the resolved configuration before starting services, and verify runtime health after every change.
Scope boundary: This skill configures and operates Woodpecker CI (the server, agents, workflows, and integrations). It does not install or administer Forgejo/Gitea itself, and it does not configure Forgejo Actions runners. When a task mentions Forgejo, treat it as the forge Woodpecker connects to unless forge administration is explicitly requested.
Operating loop
- Identify the Woodpecker major version, forge, backend, deployment files, database, public URL, and whether the task is a setup, pipeline, or incident.
- Read the matching reference below before changing configuration.
- Render and lint configuration before starting the server or agent.
- Make the smallest change at the layer that owns the problem: forge/OAuth, server, agent/backend, or repository workflow.
- Verify the result at the next boundary: server health, agent connected state, repository webhook, pipeline scheduling, step logs, and external deployment endpoint.
- Record the exact version and relevant environment variables without recording secret values.
Choose the entry point
| If the task is... | Start here |
|---|---|
| New server/agent or forge connection | references/setup.md |
| Workflow YAML, services, conditions, secrets, or plugins | references/pipeline-syntax.md |
| Upgrade, backup, metrics, CLI, or capacity | references/operations.md and references/advanced-patterns.md |
| A failed login, queued pipeline, clone, step, or backend | references/troubleshooting.md and references/failure-signatures.md |
| A trust or multi-tenant decision | references/security.md and the backend section of references/setup.md |
| Local lint/exec or CLI installation | references/cli.md |
What ships with it
16 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/troubleshooting-checklist.md 1.0 KB
- evals/evals.json 6.9 KB
- README.md 1.9 KB
- references/advanced-patterns.md 3.8 KB
- references/cli.md 1.4 KB
- references/failure-signatures.md 2.9 KB
- references/operations.md 3.3 KB
- references/pipeline-syntax.md 4.9 KB
- references/security.md 2.8 KB
- references/setup.md 4.3 KB
- references/source-index.md 2.9 KB
- references/troubleshooting.md 4.1 KB
- scripts/woodpecker-doctor.py 2.2 KB runs code
- templates/docker-compose.yml 1.4 KB
- templates/forgejo.env.example 410 B
- templates/woodpecker.yml 526 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 133 lines · 87 tokens per session scan A 201f2221575c
woodpecker-ci is a skill published in the GitHub repository magnus919/agent-skills (76 stars, last pushed yesterday), licensed MIT. It adds 87 tokens to every session and 2,074 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
devops-expert
Expert-level DevOps practices, culture, automation, and continuous delivery. Use when the user mentions CI/CD, automation, infrastructure, or culture, or when the task involves DevOps Culture or Culture & Process.
ci-generate
Generate a production-ready CI/CD pipeline config (GitHub Actions, GitLab CI, CircleCI, or Jenkins) by discovering the project's actual stack, test/build commands, and dependencies. Use when setting up CI for a new project, adding a missing workflow file, or asked to create/generate a pipeline, workflow, or…
ci-local
Run the checks a GitHub Actions workflow would run, locally, when Actions is unavailable or out of quota. Parses .github/workflows/.yml, extracts the jobs/steps that gate merges (lint, typecheck, test, build), translates them to local commands respecting the workflow's pinned node/python versions and env, executes…
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.
browser-automation
Browser automation with Playwright — testing, scraping, monitoring, form submission, screenshot capture, and multi-page interaction flows. Covers setup, navigation, element interaction, assertions, and cleanup. Primary keyword clusters: Playwright browser automation, end-to-end testing with Playwright, web scraping…
ci-cd-pipeline-generator
Generate production-ready CI/CD pipeline configurations for GitHub Actions, GitLab CI, CircleCI, and Jenkins. Activates when users ask to set up CI/CD, create deployment pipelines, automate build/test/deploy workflows, configure Docker builds, set up staging/production environments, or add quality gates. Covers…