Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/mishahanin/heading-osnpx agentmods add skills/mishahanin/heading-os/backupWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mishahanin/heading-os/backup)<a href="https://agentmods.dev/skills/mishahanin/heading-os/backup"><img src="https://agentmods.dev/badge/skills/mishahanin/heading-os/backup.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 11 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.01631 |
| Opus 5 | $0.00012 | $0.00816 |
| Sonnet 5 | $0.00005 | $0.00326 |
| Haiku 4.5 | $0.00002 | $0.00163 |
Grade A, and why
backup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backup the entire workspace to GitHub.
CEO two-part topology (engine + data): use push-all.py
The CEO workspace is split into two repos, each with its own private
origin/main. The ENGINE clone (.heading-os) holds code only. The DATA
overlay (.heading-os-data) holds all data and every artifact. One command
commits and pushes BOTH. It runs a pre-push secret scan and an ahead/behind
[0 0] verification, because a bare push can silently leave a ref behind:
python scripts/push-all.py # commit working-tree changes + push both
python scripts/push-all.py -m "msg" # custom commit message
python scripts/push-all.py --no-commit # push existing commits only
python scripts/push-all.py --dry-run # show what would happen, change nothing
It reads GH_TOKEN from the engine .env, refuses to push any tracked
secret-like file (.env, .session, cookies.json, .sessions/), and never
pushes .memory-index/ (gitignored, rebuildable). The DATA overlay is pushed
FIRST. The engine's pre-push hook runs the full suite inside the push, and data
is the only half that cannot be reconstructed. Prefer this over the manual
git steps below whenever the data overlay exists (get_data_root() differs
from the engine root). The manual steps remain the path for exec workspaces and
the pre-cutover single-repo case.
Exit 3 means at least one repository was skipped. Read the HEADLINE, not the
code, because it has two shapes and they mean opposite things to the operator.
Partial: N of M repo(s) not pushed.— the backup was partial, not failed. Report it that way. The repositories named below the headline were not pushed, for the reason printed next to each; everything else was pushed and verified.NOTHING PUSHED: all M repo(s) skipped.— nothing reached a remote and there is NO new off-machine copy. Never report this as a partial success. The exec and pre-cutover single-repo modes push one repository, so exit3there is always this shape.
In both shapes every skipped repository is still committed locally, so nothing is
lost. Tell the operator which repository was skipped, quote the reason, and give the
remedy. The remedy is usually to merge the branch into main and run the command
again. For an unarmed engine test gate, it is
python scripts/install-git-hooks.py. Do NOT re-run the command hoping for a
different answer.
Exit 1 and 2 are real failures that stopped the run. The causes are a security
refusal, a remote a repository must not push to, or an absent GH_TOKEN. They are
also a misconfigured data root, or a push that ran and did not verify.
Exit 2 with "REFUSING TO PUSH" naming a remote is the newest of those and is
different in kind from the others. It means a repository is aimed at a remote it
must not push to: the engine's own remote, or a repository GitHub reports as
public. Nothing was pushed and nothing was lost. The whole run stops rather than
continuing with the other repositories, because a wrong remote makes all of them
suspect. Report the remote it names to Misha and do not retry until it is
corrected.
Because the DATA overlay is pushed first, a failure at the ENGINE can still leave
DATA pushed and verified. Read the per-repository lines above the failure before
you tell the operator nothing was backed up. Exit 0 means everything went.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 140 lines · 24 tokens per session scan A 2e6bedd15720
backup is a skill published in the GitHub repository mishahanin/heading-os (11 stars, last pushed yesterday), licensed Apache-2.0. It adds 24 tokens to every session and 1,631 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
github
GitHub via gh CLI: PRs, issues, reviews, repos, auth.
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
taiyi-integration
A project workflow skill for closing a TaiyiForge change and recording it in a CHANGELOG.md file. It checks review results, tests, and the state of the working tree before archiving the change.
caveman-commit
Write a Conventional Commits message compressed to intent only. Use for "write a commit", "commit message", /commit or /caveman-commit.
qa
QA test your code changes by reading your git diff, choosing the right validation path for frontend/browser and backend changes, and reporting pass/fail with evidence.