Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/vscode/author-contributionsnpx skills add microsoft/vscode --skill author-contributionsgit clone --depth 1 https://github.com/microsoft/vscodeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.01774 |
| Opus 5 | $0.00034 | $0.00887 |
| Sonnet 5 | $0.00014 | $0.00355 |
| Haiku 4.5 | $0.00007 | $0.00177 |
Grade A, and why
author-contributions scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
commits = subprocess.check_output( Copies of this mod
1 near-identical copy found in the catalogue:
- author-contributions — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When asked to find all files a specific author contributed to on a branch (compared to main or another upstream), follow this procedure. The goal is to produce a simple table that both humans and LLMs can consume.
Run as a Subagent
This skill involves many sequential git commands. Delegate it to a subagent with a prompt like:
Find every file that author "Full Name" contributed to on branch
<branch>compared to<upstream>. Trace contributions through file renames. Return a markdown table with columns: Status (DIRECT or VIA_RENAME), File Path, and Lines (+/-). Include a summary line at the end.
Procedure
1. Identify the author's exact git identity
git log --format="%an <%ae>" <upstream>..<branch> | sort -u
Match the requested person to their exact --author= string. Do not guess — short usernames won't match full display names (resolve via git log or the GitHub MCP get_me tool).
2. Collect all files the author directly committed to
git log --author="<Exact Name>" --format="%H" <upstream>..<branch>
For each commit hash, extract touched files:
git diff-tree --no-commit-id --name-only -r <hash>
Union all results into a set (author_files).
3. Build rename map across the entire branch
For every commit on the branch (not just the author's), extract renames:
git diff-tree --no-commit-id -r -M <hash>
Parse lines with R status to build a map: new_path → {old_paths}.
4. Get the merge diff file list
git diff --name-only <upstream>..<branch>
These are the files that will actually land when the branch merges.
5. Classify each file in the merge diff
For each file in step 4:
- If it's in
author_files→ DIRECT - Else, walk the rename map transitively (follow chains: current → old → older) and check if any ancestor is in
author_files→ VIA_RENAME - Otherwise → not this author's contribution
6. Get diff stats
git diff --stat <upstream>..<branch> -- <file1> <file2> ...
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 187 lines · 68 tokens per session scan A 0b8c88378e18
author-contributions is a skill published in the GitHub repository microsoft/vscode (190,384 stars, last pushed today), licensed MIT. It adds 68 tokens to every session and 1,774 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pr-review
End-to-end PR reviewer for dotnet/maui. Orchestrates 3 phases — Pre-Flight, Try-Fix, Report. Gate runs separately before this skill. Use when asked to 'review PR #XXXXX', 'work on PR #XXXXX', or 'fix issue #XXXXX'.
run-integration-tests
Build, pack, and run .NET MAUI integration tests locally. Validates templates, samples, and end-to-end scenarios using the local workload.
mgmt-review-comment-resolution
Resolve review comments on Azure management-plane .NET SDK PRs. Handles renaming types/properties, changing property types, and other API surface adjustments by updating TypeSpec client.tsp and regenerating.
mpg-migration
Handles Azure SDK for .NET management-plane migrations from AutoRest/Swagger to TypeSpec; use for MPG, mgmt migration, or Azure.ResourceManager. migration requests.
roll-dice
Roll dice using a random number generator. Use when asked to roll a die (d6, d20, etc.), roll dice, or generate a random dice roll.
refresh-arm-sdk-release
WORKFLOW SKILL — Prepares Azure.ResourceManager SDK refresh pull requests in azure-sdk-for-net. WHEN: "prepare sdk refresh", "refresh Azure.ResourceManager package", "update ARM SDK from autorest tag", "refresh changelog dependencies". INVOKES: git and GitHub pull request tools for branch, commit, push, and PR…