Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add natsukium/dotfiles --skill ghqgit clone --depth 1 https://github.com/natsukium/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/natsukium/dotfiles/ghq)<a href="https://agentmods.dev/skills/natsukium/dotfiles/ghq"><img src="https://agentmods.dev/badge/skills/natsukium/dotfiles/ghq/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/natsukium/dotfiles/ghq"><img src="https://agentmods.dev/badge/skills/natsukium/dotfiles/ghq.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00162 | $0.01354 |
| Opus 5.5 | $0.00065 | $0.00542 |
| Sonnet 5.5 | $0.00032 | $0.00271 |
| Haiku 4.5 | $0.00016 | $0.00135 |
Grade A, and why
ghq scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ghq - Local Repository Management
ghq clones remote repositories into a predictable, deduplicated directory tree under ghq root (here: ~/src/private, layout <host>/<owner>/<repo>). Once a repo is there, reading it is a local filesystem operation — no API calls, no rate limits, no re-download next time.
Why this skill exists
When inspecting source code, the wasteful patterns are:
gh api repos/.../contents/<file>per file — burns a request and base64 round-trip per read, can't grep across the tree, can't follow imports.git cloneinto/tmp(ormktemp -d) — re-downloads on every session, leaves the repo unfindable later, wastes bandwidth and disk.WebFetchofraw.githubusercontent.comURLs — same problem asgh api, plus no recursion.
ghq get solves all three: it's idempotent (no-op if the repo is already cloned), it puts the repo in a path you can find again with ghq list, and once local you can use Read, Grep, Glob, and ast-grep freely.
The workflow
- Check first —
ghq list <repo>(orghq list -e <owner>/<repo>for exact match). If it prints a path, the repo is already there; skip the clone. - Clone if missing —
ghq get <owner>/<repo>. Add--shallowfor one-off inspection of a specific commit's tree, or--partial bloblessif the repo is huge (e.g., nixpkgs, linux, chromium) and you only need to navigate before reading a few files. - Resolve the path —
ghq list -p -e <owner>/<repo>returns the absolute path. Use this withRead/Grep/Glob, notcd. - Update only when needed —
ghq get -u <owner>/<repo>to pull latest. Don't update reflexively; a stale clone is usually fine for "how does X work" questions.
Anti-patterns
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 79 lines · 162 tokens per session scan A e6d24f2fdfbf
ghq is a skill published in the GitHub repository natsukium/dotfiles (106 stars, last pushed yesterday), licensed CC0-1.0. It adds 162 tokens to every session and 1,354 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autopilot
Carry a well-scoped GitHub issue through the full dev loop autonomously, stopping at a per-run tier boundary (PR-ready, or merge+deploy for small reversible changes).
deep-research-team
This skill should be used when the user asks for "deep research", "research team", "comprehensive analysis", "research report", "investigate thoroughly", "compare X vs Y in depth", or needs synthesis across multiple sources with verification. It spawns a coordinated team of researcher agents across multiple rounds…
autopilot-triage
Vet open issues for autonomous resolution and queue the qualifying ones with the autopilot-queued label — the start-of-day "fill the queue" half of the triage → run split.
create-pr
Create a pull request with auto-generated description, issue linking, ROADMAP updates, and PR-metadata validation.
merge-pr
Merge a pull request with status checks, squash merge, and branch cleanup. Handles worktree contexts.
git-commit
This skill should be used BEFORE running any git commit command. Triggers when about to run git commit. Ensures commit messages follow Conventional Commits specification.