Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/matteing/opal/ci-preflightnpx skills add matteing/opal --skill ci-preflightgit clone --depth 1 https://github.com/matteing/opalWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.00362 |
| Opus 5 | $0.00019 | $0.00181 |
| Sonnet 5 | $0.00008 | $0.00072 |
| Haiku 4.5 | $0.00004 | $0.00036 |
Grade A, and why
ci-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CI Preflight Skill
You run the same checks that GitHub Actions CI performs, but locally, to catch failures before pushing. This saves time and keeps the commit history clean.
When to act
- Before pushing a branch to remote.
- When the user asks to "run CI", "check everything", or "preflight".
- After a large set of changes to verify nothing is broken.
Check sequence
Run these in order. Stop and fix issues at each step before proceeding.
1. Elixir core
# Compile with warnings-as-errors (matches CI)
mise run build:core
# Check formatting
mise run lint:core
# Run tests
mise run test:core
2. TypeScript CLI
# Lint (ESLint)
mise run lint:cli
# Verify codegen is current
mix run scripts/codegen_ts.exs --check
# Build (typecheck + compile)
mise run build:cli
3. Quick summary
Or run everything at once:
mise run lint && mise run build && mise run test
Rules
- Every check must pass before pushing. If something fails, fix it first.
- Report results clearly — list what passed and what failed.
- For failures, diagnose the root cause and suggest or apply fixes.
- If a test is flaky (passes on retry), flag it to the user rather than silently retrying.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 61 lines · 39 tokens per session scan A fd8a27001c53
ci-preflight is a skill published in the GitHub repository matteing/opal (59 stars, last pushed 21d ago), licensed MIT. It adds 39 tokens to every session and 362 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.
agent-ops-cicd-github
Agent skill for ops-cicd-github - invoke with $agent-ops-cicd-github.
google-agents-cli-deploy
This skill should be used when the user wants to "deploy an agent", "deploy my ADK agent", "set up CI/CD", "configure secrets", "troubleshoot a deployment", or needs guidance on Agent Runtime, Cloud Run, or GKE deployment targets, or binding an agent to an Agent Gateway. Covers deployment workflows, service accounts…
ci-security-scanning-with-strix
Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner)…
pre-push
Runs the local equivalent of the CI merge gate before you push. Detects which areas (Python, TypeScript, docs) your changes touch, auto-fixes what it can, then runs only those checks. Use when the user asks to run pre-push checks, get push-ready, verify changes before pushing or opening a PR, "make sure CI will pass"…
babysit
Same-session monitoring loop for PRs, CI runs, tickets, and deployments using the monitorstart / monitorupdate / autonudgestop MCP tools. The loop re-injects your check instructions into THIS session on an idle interval — same context, same tools — and works from dashboard chat, Slack threads, and Discord DMs. Use…