Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nirholas/three.ws/gcp-triagenpx skills add nirholas/three.ws --skill gcp-triagegit clone --depth 1 https://github.com/nirholas/three.wsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nirholas/three.ws/gcp-triage)<a href="https://agentmods.dev/skills/nirholas/three.ws/gcp-triage"><img src="https://agentmods.dev/badge/skills/nirholas/three.ws/gcp-triage.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.01762 |
| Opus 5 | $0.00046 | $0.00881 |
| Sonnet 5 | $0.00019 | $0.00352 |
| Haiku 4.5 | $0.00009 | $0.00176 |
Grade A, and why
gcp-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GCP production triage: monitor, classify, fix
The vercel logs era is over; production is 20 Cloud Run services in project
aerial-vehicle-466722-p5 (region us-central1). This skill is the loop an
agent runs to answer "is production healthy?" and to act on what it finds.
gcloud is already authenticated in this workspace.
Step 1: run the monitor
When the user asks "what's wrong with three.ws?" (or anything equally broad), run the DEEP sweep; it checks everything, not just what happened to log:
npm run triage:gcp -- --json --deep --since 6h # agents: always --json
For a quick pulse check mid-incident, the fast form is still fine:
npm run triage:gcp -- --json --since 1h
The base monitor merges three signals and classifies every distinct problem signature:
https://three.ws/api/healthz: the platform's own subsystem roll-up (database, cache, Helius, x402 ring, world, sniper).- A WARNING+ log sweep across every Cloud Run service, fingerprinted so repeats group into one finding.
- HTTP request logs: 5xx groups per route, 429s.
--deep adds nine concurrent read-only probes, each wrapping an existing
standalone audit, normalized into the same findings stream:
| probe | what it proves | wraps |
|---|---|---|
version |
/api/version answers; deployed commit is in local history; deploy lag counted |
built-in |
tls |
certs on three.ws + world.three.ws have >21 days left | built-in |
fleet |
every Cloud Run service's latest revision is Ready | gcloud run services list |
pages |
every page advertised in data/pages.json serves on the live site |
scripts/check-pages.mjs --base |
cron-drift |
vercel.json crons match live Cloud Scheduler jobs | scripts/check-cron-drift.mjs |
cron-liveness |
every cron routes, resolves a handler, and loads | scripts/audit-cron-liveness.mjs --static |
db-migrations |
no migration is pending against the database | scripts/apply-migrations.mjs --check |
service-wallets |
signer wallets above SOL floors; advertised x402 keys match secrets | scripts/audit-service-wallets.mjs |
custodial-keys |
no funded custodial wallet sits behind an undecryptable key | scripts/audit-custodial-key-health.mjs |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 122 lines · 93 tokens per session scan A 65259fa24498
gcp-triage is a skill published in the GitHub repository nirholas/three.ws (110 stars, last pushed today), licensed Apache-2.0. It adds 93 tokens to every session and 1,762 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
architecture-diagrams
Create professional software architecture diagrams with animated reveals using the Excalimate MCP server. Use when asked to visualize system architecture, microservices, cloud infrastructure, API gateways, service meshes, layered architectures, or any system design — even if the user doesn't explicitly say…
blockchain-infrastructure
Use this skill when asked about blockchain node deployment, RPC infrastructure, CI/CD for smart contracts, monitoring and alerting for blockchain networks, MEV infrastructure (Flashbots, builders, relays), key management (KMS, HSM), and environment management for devnet/testnet/staging/mainnet. Languages: Go, Rust…
analyzing-ethereum-smart-contract-vulnerabilities
Use when perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet. Use when performing static and symbolic analysis of solidity smart contracts using.
cloudflare-observability-review
Investigate live Cloudflare Workers observability for stellar-raven-codemode. Use when reviewing production MCP request logs, playground/demo telemetry, traces, Ray IDs, request headers, telemetry query results, eval observability, agent-run forensics, or whether Cloudflare metadata is enough without app-level…
blender-mcp
Drive Blender via the catalog blender MCP, with bpy recipes.
blender-mcp
Control Blender directly from Gauss via socket connection to the blender-mcp addon. Create 3D objects, materials, animations, and run arbitrary Blender Python (bpy) code. Use when user wants to create or modify anything in Blender.