Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mahmoud20138/tradecraft/github-actions-triggernpx skills add mahmoud20138/Tradecraft --skill github-actions-triggergit clone --depth 1 https://github.com/mahmoud20138/TradecraftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mahmoud20138/tradecraft/github-actions-trigger)<a href="https://agentmods.dev/skills/mahmoud20138/tradecraft/github-actions-trigger"><img src="https://agentmods.dev/badge/skills/mahmoud20138/tradecraft/github-actions-trigger.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00032 | $0.00698 |
| Opus 5 | $0.00016 | $0.00349 |
| Sonnet 5 | $0.00006 | $0.00140 |
| Haiku 4.5 | $0.00003 | $0.00070 |
Grade A, and why
github-actions-trigger scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
return requests.post(endpoint, headers=self.headers, How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Actions Trigger — CI/CD Bridge
You are a GitHub Actions integration bridge. You trigger workflows, monitor runs, and report results back to Claude Code.
Setup
GH_TOKEN = "ghp_YOUR_TOKEN"
GH_OWNER = "your-username"
GH_REPO = "your-repo"
Save: /context-memory save gh_token=<token> gh_repo=owner/repo
Trigger a Workflow
/github-actions-trigger run workflow_file=ci.yml
/github-actions-trigger run workflow_file=deploy.yml branch=main
/github-actions-trigger run workflow_file=test.yml inputs='{"env":"staging"}'
Monitor Run Status
/github-actions-trigger status run_id=12345678
/github-actions-trigger latest workflow=ci.yml
/github-actions-trigger logs run_id=12345678
Pre-built Integration Flows
After /run-pre-commit-checks passes:
/github-actions-trigger run workflow=ci.yml
→ Monitor status every 30s
→ Report pass/fail back
After /code-review approves:
/github-actions-trigger run workflow=deploy-staging.yml
→ Get deployment URL
→ Send to /discord-webhook
After /run-e2e-tests completes:
/github-actions-trigger run workflow=deploy-prod.yml
→ Requires all tests passed
→ Notify via /telegram-bot
API Functions
import requests
class GitHubActions:
BASE = "https://api.github.com"
def __init__(self, token, owner, repo):
self.headers = {"Authorization": f"token {token}",
"Accept": "application/vnd.github+json"}
self.url = f"{self.BASE}/repos/{owner}/{repo}"
def trigger(self, workflow_id: str, ref: str = "main", inputs: dict = {}):
endpoint = f"{self.url}/actions/workflows/{workflow_id}/dispatches"
return requests.post(endpoint, headers=self.headers,
json={"ref": ref, "inputs": inputs})
def get_runs(self, workflow_id: str):
endpoint = f"{self.url}/actions/workflows/{workflow_id}/runs"
return requests.get(endpoint, headers=self.headers).json()
def get_logs(self, run_id: int):
endpoint = f"{self.url}/actions/runs/{run_id}/logs"
return requests.get(endpoint, headers=self.headers)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 106 lines · 32 tokens per session scan A 3ee478b5f08e
github-actions-trigger is a skill published in the GitHub repository mahmoud20138/Tradecraft (14 stars, last pushed 4mo ago), licensed MIT. It adds 32 tokens to every session and 698 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ci-cd
Use when building or fixing a delivery pipeline. Covers pipeline structure, caching, test parallelization, deployment strategies, secrets, and making the pipeline fast enough that people do not route around it.
mobile-release
Use when preparing a mobile app for release. Covers versioning, signing, staged rollout, crash monitoring, store review requirements, and rollback when an update goes wrong.
neo-azure-pipelines
Use this skill when the user asks to create, review, debug, or modernize Azure Pipelines YAML for CI/CD, especially .NET builds, Azure App Service deploys, or IIS/on-premises deploys. Prefer bundled templates and verify task syntax against Microsoft docs when version-specific accuracy matters.
gen-ci
Generate GitHub Actions CI workflows for this repository. TRIGGER ON: 'generate CI', 'add GitHub Actions', 'create CI workflow', 'set up CI', 'add CI/CD', 'create a CI pipeline', 'generate CI/CD', 'add continuous integration', 'set up GitHub Actions', 'add a lint+test workflow', 'add governance check', 'add PR health…
offensive-cicd-pipeline
Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflowrun event abuse, GITHUBTOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code…
ci-preflight
Run before pushing any branch that adds shipped files, hooks, or platform-specific code. Prevents the CI-whiplash pattern — multiple red pushes that could have been caught locally.