OpenShell is a runtime for autonomous AI agents that executes them in sandboxed environments governed by declarative policies. It is used to restrict agents' access to files, credentials, data, and network resources, and the catalogue includes skills and workflows for operating and contributing to it.
Borrowing it
Nothing to install: this file belongs to NVIDIA/OpenShell. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/NVIDIA/OpenShell/main/.agents/skills/watch-github-actions/SKILL.mdgit clone --depth 1 https://github.com/NVIDIA/OpenShellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nvidia/openshell/watch-github-actions)<a href="https://agentmods.dev/skills/nvidia/openshell/watch-github-actions"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/watch-github-actions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nvidia/openshell/watch-github-actions"><img src="https://agentmods.dev/badge/skills/nvidia/openshell/watch-github-actions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.03190 |
| Opus 5.5 | $0.00029 | $0.01276 |
| Sonnet 5.5 | $0.00015 | $0.00638 |
| Haiku 4.5 | $0.00007 | $0.00319 |
Grade A, and why
watch-github-actions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 347 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Watch GitHub Actions
Monitor GitHub Actions workflow runs using the gh CLI.
Prerequisites
- The
ghCLI must be authenticated (gh auth status) - You must be in a git repository with a GitHub remote
Quick Status Check
List recent workflow runs for the current branch:
gh run list --branch "$(git branch --show-current)"
List all recent runs:
gh run list
Watch a Run in Real Time
Watch a workflow run until it completes:
gh run watch
Watch a specific run:
gh run watch <run-id>
This will continuously update the status until the run finishes (success, failure, or cancelled).
View Run Details
View a specific run with job details:
gh run view <run-id>
View with full log output:
gh run view <run-id> --log
View a failed job's log:
gh run view <run-id> --log-failed
Check Runs for a Specific Branch
Current branch:
gh run list --branch "$(git branch --show-current)"
Specific branch:
gh run list --branch main
gh run list --branch feature-branch
Check Runs for a PR
List workflow runs associated with a PR:
# Get the head branch of the PR, then list runs
BRANCH=$(gh pr view <pr-number> --json headRefName --jq '.headRefName')
gh run list --branch "$BRANCH"
Or view the checks directly on the PR:
gh pr checks <pr-number>
List Recent Runs
List runs for the current project:
gh run list
Filter by status:
gh run list --status failure
gh run list --status success
gh run list --status in_progress
Filter by workflow:
gh run list --workflow "CI"
JSON output for scripting:
gh run list --json databaseId,status,headBranch,url --jq '.[] | {id: .databaseId, status: .status, branch: .headBranch, url: .url}'
View Job Logs
For Kubernetes app-listener E2E failures during kind setup, inspect the uploaded
results/app-listener/cni-setup/ evidence. It includes node and Calico pod
descriptions, events, and current/previous container logs. A CNI rollout timeout
occurs before the listener tests run; use these diagnostics to distinguish image
pulls, init failures, and readiness failures.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +7 lines f2f2a46def95
- 2d ago Changed f7df78b4375f
- 3d ago Changed · +6 lines 9c88801a5ae1
- 6d ago Changed · +7 lines 687e8ff90032
- 8d ago Changed c4944bc34c14
- 9d ago Changed · +2 lines ebe71523511a
- 10d ago Changed · +7 lines 2438d293ca2c
- 17d ago Changed · +4 lines 9b250601fc06
- 18d ago Changed · +20 lines 18ed78decdf6
- 22d ago First seen · 294 lines · 73 tokens per session scan A 55790c170c9c
watch-github-actions is a skill published in the GitHub repository NVIDIA/OpenShell (21,172 stars, last pushed yesterday), licensed Apache-2.0. It adds 73 tokens to every session and 3,190 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
watch-github-actions compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| watch-github-actionsNVIDIA/OpenShell | Skill | 21k | yesterday | Apache-2.0 | A | 73 | Claude Code, Codex |
| chinese-git-workflowjnMetaCode/superpowers-zh | Skill | 8.5k | 11d ago | MIT | A | 69 | Claude Code |
| atmos-profilescloudposse/atmos | Skill | 1.4k | today | Apache-2.0 | A | 35 | Claude Code |
| webhook-managementhoangsonww/Claude-Code-Agent-Monitor | Skill | 1.1k | yesterday | MIT | A | 56 | Claude Code, Codex |
| monorepo-managementwshobson/agents | Skill | 42k | yesterday | MIT | C | 54 | Claude Code |
| managing-github-actions-secretsPostHog/posthog-foss | Skill | 728 | today | MIT | A | 67 | Claude Code, Codex |
| postman-newman-automationLambdaTest/agent-skills | Skill | 390 | yesterday | MIT | A | 156 | Claude Code, Codex |