Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NicoGenti/opencode-orchestrator-kit --skill npm-debuggit clone --depth 1 https://github.com/NicoGenti/opencode-orchestrator-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nicogenti/opencode-orchestrator-kit/npm-debug)<a href="https://agentmods.dev/skills/nicogenti/opencode-orchestrator-kit/npm-debug"><img src="https://agentmods.dev/badge/skills/nicogenti/opencode-orchestrator-kit/npm-debug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nicogenti/opencode-orchestrator-kit/npm-debug"><img src="https://agentmods.dev/badge/skills/nicogenti/opencode-orchestrator-kit/npm-debug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.01455 |
| Opus 5.5 | $0.00030 | $0.00582 |
| Sonnet 5.5 | $0.00015 | $0.00291 |
| Haiku 4.5 | $0.00008 | $0.00145 |
Grade D, and why
npm-debug scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Cause: previous `sudo npm install -g` left root-owned files behind, or a corporate policy denies global Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
non-destructive triage playbook; never auto-runs `rm -rf node_modules` or cache wipes without explicit How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
npm / Node Toolchain Debugging
A bounded playbook for diagnosing npm/Node toolchain failures. This skill is opt-in for npm-helper and
SHOULD be loaded only after the orchestrator has classified the failure as npm/Node-related (see
agents/orchestrator.md "Routing Disambiguation: deploy-helper vs build-helper vs npm-helper vs pc-doctor").
Scope
In scope:
npm install,npm ci,npm update, andnpxfailures.package.json/package-lock.jsonpeer-dependency and version-resolution conflicts.- Node version mismatches (
engines,.nvmrc,nvm, Volta, Corepack). - npm cache integrity errors and registry connectivity issues.
- Script-time runtime errors caused by missing binaries (
node_modules/.bin) or wrongPATH.
Out of scope — delegate to another helper:
- TypeScript / Vite / webpack build errors →
build-helper(skills/build-debug). - CI/CD or deploy-platform failures →
deploy-helper(skills/github-actions-cicd). - Windows-local PATH, registry, or service issues →
pc-doctor.
Triage Order (Read Before Acting)
- Capture the exact failing command and its full stderr. Do not paraphrase; quote it verbatim in the report.
- Note the working directory.
npmresolves relative to the current shell, not the repo root, so "ran in the wrong folder" is a common false lead. - Confirm Node + npm versions:
node -v,npm -v, and compare toengines.nodeinpackage.jsonand to.nvmrcif present. A version mismatch usually explains peer-dep errors and engine warnings. - Inspect lockfile state:
git status package.json package-lock.json. Ifpackage-lock.jsonis modified locally or missing, prefernpm ciovernpm installto reproduce CI exactly. - Reproduce minimally: run the same command with
--no-audit --no-fundfirst to remove noise. Only escalate to--verboseor--loglevel sillyonce the simple repro fails the same way.
Common Failures and First-Line Fixes
EACCES / permission errors on global installs
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 116 lines · 76 tokens per session scan D e69911dca203
npm-debug is a skill published in the GitHub repository NicoGenti/opencode-orchestrator-kit (7 stars, last pushed yesterday), licensed MIT. It adds 76 tokens to every session and 1,455 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
rust-check
Run cargo check on the current Rust project to find compile errors.
debug
Reproduce, minimize, localize, identify root cause, and distinguish diagnosis from an authorized fix. Prefer root-cause over symptom patches.
feedback
Skill "feedback" from Hmbown/Codewhale, covering feedback, when to use, setup, workflow and non-goals.
cao-workflow
Author and run CAO Python workflow scripts — multi-step, parameterized, fan-out orchestrations executed by cao workflow run. Use when the user wants a repeatable multi-step job (e.g. data analysis over many files, a review pipeline, a parameterized batch). Authoring ends at a validated script file; running it is a…
cao-plugin
Create a new CAO (CLI Agent Orchestrator) plugin. Use this skill whenever the user wants to add a plugin that reacts to CAO lifecycle or messaging events, scaffold a plugin package, understand plugin requirements, or integrate an external system (Discord, Slack, dashboards, logging, metrics) with CAO. Also use when…
oversight-team
Use when you are a seat on the oversight pod (a standing monitor-mode rig that keeps OTHER rigs healthy), configuring or running the drift detectors, or choosing whether to intervene vs escalate. Covers the pull-not-poll posture, the v0 detectors (premature-park, process-drift, off-task, token-burn), the intervention…