Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mvschwarz/openrig --skill cross-host-rig-commandsgit clone --depth 1 https://github.com/mvschwarz/openrigWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mvschwarz/openrig/cross-host-rig-commands)<a href="https://agentmods.dev/skills/mvschwarz/openrig/cross-host-rig-commands"><img src="https://agentmods.dev/badge/skills/mvschwarz/openrig/cross-host-rig-commands.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 62 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00113 | $0.02228 |
| Opus 5 | $0.00056 | $0.01114 |
| Sonnet 5 | $0.00023 | $0.00446 |
| Haiku 4.5 | $0.00011 | $0.00223 |
Grade A, and why
cross-host-rig-commands scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cross-Host Rig Commands
A first-class OpenRig surface for issuing rig commands against a
remote host via single-hop SSH. v0 productizes the existing SSH-envelope
operator pattern (ssh <host> rig <cmd>) with declared host identity,
explicit cross-host invocation path, preserved --verify semantics, and
4 named failure modes.
The live host registry may contain SSH or HTTP read-through/tunnel entries.
Use each registry entry as ground truth for transport shape. HTTP entries
require url plus exactly one of bearer_file or bearer_env.
v0 is CLI-side shell-out only — packages/daemon/ is NOT touched.
The remote host has its own managed rig available on $PATH.
Use this when
- Driving a Tart VM from the host (the immediate cross-host consumer)
- Operating Mac host A against Mac host B
- Reading remote state via
rig ps --host/rig whoami --host - Sending or capturing on a remote rig session (
rig send/capture --host <id>) - Authoring a
~/.openrig/hosts.yamlregistry entry
Don't use this when
- The target is local. Don't pass
--hostfor local commands. - You need multi-hop SSH (host A → host B → host C). v0 is single-hop only.
- You want reverse direction (remote initiates back to local). v0 is originator-pull only.
- Cross-host seat handover (moving a durable owned seat across hosts) — deferred to higher-level primitives. (Cross-host queue writes, by contrast, now ship — see "Cross-host queue writes" below.)
- The transport isn't SSH. v0 supports
transport: sshonly.
Cross-host queue writes (updated 2026-07-21 vs main d37a08ad)
Cross-host queue writes are no longer deferred — they ship — but the rule
differs from the interactive verbs (send/capture/ps/whoami):
- Queue writes are EXPLICIT-only. Address the target host explicitly with
--host <id>or themember@rig@<host>form. A queue write never follows a persisted host selection. host selectstickiness does NOT apply to queue.host selectaffects theresolveEffectiveHostverbs (send/capture/ps/whoami) — those follow the selected host — but a queue write ignores it and requires explicit addressing.- Host address parsing differs between the interactive verbs and the queue verbs; do not assume the interactive form carries over. When unsure, address the host explicitly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 189 lines · 113 tokens per session scan A c3c12955d400
cross-host-rig-commands is a skill published in the GitHub repository mvschwarz/openrig (66 stars, last pushed 2d ago), licensed Apache-2.0. It adds 113 tokens to every session and 2,228 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dynamic-resources
Example skill loaded from resourcesdiscover.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
autoprompt
Explicit-only useful-first orchestration. Invoke /autoprompt to turn a mission into one executable roadmap, build dependency-safe lanes, and verify the result with independent reviewers. Never infer invocation from ordinary requests. Never resume from leftover artifacts without an explicit resume instruction.
swarm-pr-review
Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…
bundle-safety
Bundle transform safety — minification variant selection, consumer-constraint verification, identifier preservation, and namespace re-export coverage for build output.