A contributor guide for Pilot CLI, an AI-powered command-line platform, organized as a monorepo. A monorepo is one repository containing several related packages and integrations.

Use it when adding Pilot commands, changing its terminal interface, working across packages, or writing end-to-end tests.

It gives contributors the project's structure, conventions, testing approach, and established implementation patterns.

pilot-dev — Skill for Claude Code and Codex by Medal-Social: A contributor guide for Pilot CLI, an AI-powered command-line…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/medal-social/pilot/pilot-dev

Any agent

npx skills add Medal-Social/Pilot --skill pilot-dev

Clone the repo

git clone --depth 1 https://github.com/Medal-Social/Pilot

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/medal-social/pilot/pilot-dev.svg)](https://agentmods.dev/skills/medal-social/pilot/pilot-dev)

Your own site

<a href="https://agentmods.dev/skills/medal-social/pilot/pilot-dev"><img src="https://agentmods.dev/badge/skills/medal-social/pilot/pilot-dev.svg" alt="Measured on agentmods" height="20"></a>

Per session 22 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,170 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00022	$0.01170
Opus 5	$0.00011	$0.00585
Sonnet 5	$0.00004	$0.00234
Haiku 4.5	$0.00002	$0.00117

Measured 4d ago against content hash e65637887dae, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

pilot-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/pilot-dev/SKILL.md · 116 lines

How it starts

The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Pilot Dev — Contributor Skill

You are developing Pilot CLI, Medal Social's AI-powered CLI platform.

Monorepo Structure

packages/
  cli/                  ← Main package (@medalsocial/pilot)
    src/
      commands/         ← Commander.js command definitions
      screens/          ← React Ink full-screen UIs (split-panel pattern)
      components/       ← Reusable Ink components (TabBar, SplitPanel, StatusBar)
      ai/               ← AI layer (Vercel AI SDK + Claude)
      crew/             ← Crew routing — Brand, Marketing, Tech, CS, Sales leads
      lib/              ← Shared utilities, logger, errors, config
      theme/            ← Design tokens, colors, typography
    tests/
      e2e/              ← End-to-end tests with isolated PILOT_HOME
  plugins/
    kit/                ← @medalsocial/kit — machine setup, dev environment
    sanity/             ← @medalsocial/sanity — CMS integration
    pencil/             ← @medalsocial/pencil — design tool integration

Adding a New Command

Create packages/cli/src/commands/<name>.ts
Export a function that registers with Commander.js
Wire it in packages/cli/src/commands/index.ts
If it needs a screen, create packages/cli/src/screens/<Name>.tsx
Write tests first (TDD) — co-located: <Name>.test.tsx

Adding a New Screen

Screens use the split-panel layout (SplitPanel + TabBar):

Create packages/cli/src/screens/<Name>.tsx
Use SplitPanel for the canonical two-column layout
Use TabBar for navigation between sections
Import colors from the design token system, never hardcode hex values
Co-locate test: <Name>.test.tsx

Adding a Component

Create in packages/cli/src/components/<Name>.tsx
Use design tokens from theme/colors.ts for all colors
Support light/dark via the T:mode token system
Co-locate test: <Name>.test.tsx

Plugin Development

Plugins live in packages/plugins/<name>/ and follow this pattern:

plugin.toml — manifest with Zod validation, declares:
- Commands the plugin adds
- MCP servers it needs
- Permissions it requires
src/index.ts — plugin entry point
Package name: @medalsocial/<name>

Read the full file on GitHub · 116 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

4d ago First seen · 116 lines · 22 tokens per session scan A e65637887dae

Subscribe to this mod's changes

pilot-dev is a skill published in the GitHub repository Medal-Social/Pilot (2 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 22 tokens to every session and 1,170 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

agent claude codex medalsocial pilot pilot-cli

aatmf-t10-confidentiality-breach

AATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.

PurpleAILAB/Decepticon · 39 tokens

mochi-remind

Handle due reminders — notify the user with natural language and mark them done.

kirodotdev/KiroCrew · 20 tokens

memory

Use when the user asks to remember, recall, forget, update, search, or inspect durable OpenSquilla memory, including profile facts in USER.md and long-term notes in MEMORY.md or memory//.md.

opensquilla/opensquilla · 44 tokens

lazarus-group

Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.

PurpleAILAB/Decepticon · 51 tokens

sidewinder-rattlesnake

Adversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.

PurpleAILAB/Decepticon · 48 tokens

ha-data-stores

Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…

shiwenwen/hope-agent · 115 tokens