Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mathematic-inc/earl/setup-earlnpx skills add mathematic-inc/earl --skill setup-earlgit clone --depth 1 https://github.com/mathematic-inc/earlWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00067 | $0.01898 |
| Opus 5 | $0.00034 | $0.00949 |
| Sonnet 5 | $0.00013 | $0.00380 |
| Haiku 4.5 | $0.00007 | $0.00190 |
Grade D, and why
setup-earl scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
**macOS / Linux (prefer — no sudo required):** Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://raw.githubusercontent.com/mathematic-inc/earl/main/scripts/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`earl call provider.command --param value` instead of raw `curl`, `gh`, `stripe-cli`, etc. How it starts
The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Earl
Earl is an AI-safe CLI that sits between your agent and external services. Agents run
earl call provider.command --param value instead of raw curl, gh, stripe-cli, etc.
Secrets stay in the OS keychain. Every request follows a reviewed HCL template.
Process
- Install — get Earl running
- Demo — show a working example immediately
- Connect — configure MCP for your agent platform and write CLAUDE.md instructions
- Route — migrate existing CLI calls or create a new template
- Lock down — optionally enforce Earl usage at the platform level
Phase 1: Install
Check if Earl is already installed:
which earl && earl --version
If installed, print the version and skip to Phase 2.
If not installed, detect the environment and install:
macOS / Linux (prefer — no sudo required):
cargo install earl
This requires the Rust toolchain and Node.js + pnpm (Earl embeds web playground assets at compile time). If either is missing, fall back to the install script:
curl -fsSL https://raw.githubusercontent.com/mathematic-inc/earl/main/scripts/install.sh | bash
Windows (PowerShell):
irm https://raw.githubusercontent.com/mathematic-inc/earl/main/scripts/install.ps1 | iex
After install, verify:
earl doctor
If earl doctor reports errors, invoke troubleshoot-earl before continuing.
Phase 2: Quick Demo
Import the no-auth system template and run it so the user sees Earl work immediately. First check if it's already imported to avoid overwriting any customizations:
earl templates list | grep -E "^system\." || earl templates import https://raw.githubusercontent.com/mathematic-inc/earl/main/examples/bash/system.hcl
earl call --yes --json system.list_files --path .
This lists files in the current directory. The user now has a mental model: templates define
commands, earl call runs them.
Show available templates:
earl templates list
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 235 lines · 67 tokens per session scan D 822777a1ac89
setup-earl is a skill published in the GitHub repository mathematic-inc/earl (113 stars, last pushed 6d ago), licensed Apache-2.0. It adds 67 tokens to every session and 1,898 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-design-patterns
Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices.
api-design
Use when settling the contract of an API you expose, before implementation: resources/URLs, REST vs GraphQL, versioning, one RFC 9457 error envelope, pagination, idempotency — emitted as OpenAPI 3.1. NOT implementing the endpoints (that is fastapi/nestjs/go/nodejs), NOT auth hardening (that is secure-coding), NOT…
api-designer
Designs production-grade APIs — REST, GraphQL, gRPC, and AsyncAPI patterns including pagination, versioning, error handling, rate limiting, and API governance. Use when the user asks to design APIs, create endpoints, build an API layer, write OpenAPI specs, or needs help with REST/GraphQL/gRPC service design.
api-design
Design and implement RESTful APIs with proper routing, validation, error handling, and documentation. Use when building new API endpoints, designing API architecture, or improving existing APIs.
api-design
RESTful, GraphQL, gRPC, and API best practices.
api-design-first
Design-first API development skill. Generates OpenAPI 3.1 specifications, enforces REST design best practices, validates endpoints, handles versioning, pagination, error formatting, authentication patterns, rate limiting, and idempotency. Activates when users say "design an API", "create OpenAPI spec", "API endpoint"…