Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mehdiforoozandeh/crux --skill crux-cockpitgit clone --depth 1 https://github.com/mehdiforoozandeh/cruxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mehdiforoozandeh/crux/crux-cockpit)<a href="https://agentmods.dev/skills/mehdiforoozandeh/crux/crux-cockpit"><img src="https://agentmods.dev/badge/skills/mehdiforoozandeh/crux/crux-cockpit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mehdiforoozandeh/crux/crux-cockpit"><img src="https://agentmods.dev/badge/skills/mehdiforoozandeh/crux/crux-cockpit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00197 | $0.04630 |
| Opus 5.5 | $0.00079 | $0.01852 |
| Sonnet 5.5 | $0.00039 | $0.00926 |
| Haiku 4.5 | $0.00020 | $0.00463 |
Grade C, and why
crux-cockpit scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsS "$URL/snapshot.json" | python3 -c \ Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
and `/snapshot.json` must have answered 200 from *your* curl. A URL you haven't verified How it starts
The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.
crux-cockpit — launch the crux GUI, beginning to finish
The cockpit is crux's read-only browser GUI: crux serve boots a stdlib HTTP server
on 127.0.0.1, serves the webui/ frontend, and exposes the vault as /snapshot.json
(status-colored tree — pan / zoom / collapse / search / re-orient / focus one question —
plus the review queue, node detail with rendered markdown, and a hypothesis's linked report
and figures; live-refreshing, zero writes). Either panel can go full-screen ([ / ],
Esc restores). The engine does the serving; you (the
agent) do the operating: find the vault, launch clean, verify, hand over one URL, and
manage the server's lifecycle. The user should never have to touch a terminal on the
machine you run on — the one thing you can't do for them is start a local ssh -L
tunnel (plain-SSH contexts only; see Local vs remote).
The engine rides in the crux skill: ENGINE = <crux skill>/scaffold/crux.py — the
crux skill is this skill's sibling directory in your skills dir (in a repo clone,
skills/crux). If that engine file is missing, the crux skill isn't installed: install
it first (npx skills add mehdiforoozandeh/crux --all, or the repo's ./install.sh)
before continuing.
Ground rules (load-bearing)
- Never report an unverified URL. Before telling the user the cockpit is up, both
/and/snapshot.jsonmust have answered 200 from your curl. A URL you haven't verified does not leave your mouth. - URL only — never pop a browser. Always launch with
--no-openand deliver the URL as a clickable link. The user opens it when ready. One carve-out: in VS Code Remote-SSH the sanctioned way to create the port forward is an open call (code --openExternal— see the ladder below); there, opening the user's browser is the mechanism, not a discourtesy. - Always fresh, per vault. A launch first kills any cockpit already serving that vault — and never touches cockpits serving other vaults (several can coexist on different ports).
- The cockpit is read-only. No route writes; every mutation stays in the agent/CLI. Never present it as an editor.
- Surface engine-drift warnings. If the launch log warns that the vault was stamped by a different engine version, relay that warning to the user verbatim.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 291 lines · 197 tokens per session scan C ab41eb762337
crux-cockpit is a skill published in the GitHub repository mehdiforoozandeh/crux (18 stars, last pushed today), licensed MIT. It adds 197 tokens to every session and 4,630 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ab-testing
Use when designing or analyzing a controlled experiment — falsifiable hypothesis, sample size from an MDE, reading significance/CI/power, CUPED, or rescuing tests that won't go significant. NOT recurring metric tracking (that is analytics), NOT north-star/KPI trees (that is kpi-framework), NOT projecting metrics…
research-manager
Use this when starting a new research project or managing a complex, multi-step research workflow.
academic-writing
You must use this when producing any research prose — literature reviews, syntheses, analyses, methodology descriptions, discussion sections, abstracts, or any written output intended for an academic audience.
ab-testing-ecommerce
Run controlled experiments on product pages, checkout flows, and pricing to find what converts best using statistical significance testing.
systematic-review
You must use this when conducting PRISMA-standard systematic reviews, protocol development, or Risk of Bias assessment.
hypothesis-testing
You must use this when formulating testable hypotheses, designing experimental controls, or defining falsification criteria.