Borrowing it
Nothing to install: this file belongs to malwarebo/nyrve. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/malwarebo/nyrve/main/.github/skills/author-contributions/SKILL.mdgit clone --depth 1 https://github.com/malwarebo/nyrveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/malwarebo/nyrve/author-contributions)<a href="https://agentmods.dev/skills/malwarebo/nyrve/author-contributions"><img src="https://agentmods.dev/badge/skills/malwarebo/nyrve/author-contributions.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01774 |
| Opus 5 | $0.00034 | $0.00887 |
| Sonnet 5 | $0.00014 | $0.00355 |
| Haiku 4.5 | $0.00007 | $0.00177 |
Grade A, and why
author-contributions scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
commits = subprocess.check_output( This is a copy
100% identical to author-contributions — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When asked to find all files a specific author contributed to on a branch (compared to main or another upstream), follow this procedure. The goal is to produce a simple table that both humans and LLMs can consume.
Run as a Subagent
This skill involves many sequential git commands. Delegate it to a subagent with a prompt like:
Find every file that author "Full Name" contributed to on branch
<branch>compared to<upstream>. Trace contributions through file renames. Return a markdown table with columns: Status (DIRECT or VIA_RENAME), File Path, and Lines (+/-). Include a summary line at the end.
Procedure
1. Identify the author's exact git identity
git log --format="%an <%ae>" <upstream>..<branch> | sort -u
Match the requested person to their exact --author= string. Do not guess — short usernames won't match full display names (resolve via git log or the GitHub MCP get_me tool).
2. Collect all files the author directly committed to
git log --author="<Exact Name>" --format="%H" <upstream>..<branch>
For each commit hash, extract touched files:
git diff-tree --no-commit-id --name-only -r <hash>
Union all results into a set (author_files).
3. Build rename map across the entire branch
For every commit on the branch (not just the author's), extract renames:
git diff-tree --no-commit-id -r -M <hash>
Parse lines with R status to build a map: new_path → {old_paths}.
4. Get the merge diff file list
git diff --name-only <upstream>..<branch>
These are the files that will actually land when the branch merges.
5. Classify each file in the merge diff
For each file in step 4:
- If it's in
author_files→ DIRECT - Else, walk the rename map transitively (follow chains: current → old → older) and check if any ancestor is in
author_files→ VIA_RENAME - Otherwise → not this author's contribution
6. Get diff stats
git diff --stat <upstream>..<branch> -- <file1> <file2> ...
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 187 lines · 68 tokens per session scan A 0b8c88378e18
author-contributions is a skill published in the GitHub repository malwarebo/nyrve (5 stars, last pushed 2mo ago), licensed MIT. It adds 68 tokens to every session and 1,774 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). It is 100% identical to author-contributions, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
repo-conventions
Repository conventions for commits, pull requests, and tests in this example project.
git-commit
Create git commits using Nimbalyst's interactive commit proposal widget. ONLY use when the user explicitly clicks "Commit with AI" button or asks for "smart commit". For regular commit requests, use standard git commands instead.
plugin-code-review-orchestrated
Orchestrates a code review of the spring-plugin repository through scope/context passes, routing, domain reviewer subskills, and per-artifact validation. Use when asked to review a PR, diff, commit, branch, module, or file set, to run a full orchestrated review, or to produce a validated review report.
review-scope-resolver
Normalizes a PR, diff, commit, branch, file list, directory, module, class, or function into an exact review target with semantic clusters and routing signals for domain reviewer subskills. Use as the first pass of an orchestrated code review, when asked to resolve review scope, or when a raw review reference must be…
github
Complete guide for the GitHub plugin — REST API access for repositories, issues, pull requests, actions, releases, and search using a GitHub Personal Access Token.
develop-inspection-feature
End-to-end workflow for adding a new inspection or quick-fix feature to the explyt/spring-plugin repository: duplicate check, fact verification against authoritative javadoc, base-class and gating choice (isAvailableForFile), visible-element highlighting, registration, platform tests, branch and PR. Use when the user…