Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/oleksbard/cosmobar/skillnpx skills add oleksbard/cosmobar --skill skillgit clone --depth 1 https://github.com/oleksbard/cosmobarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/oleksbard/cosmobar/skill)<a href="https://agentmods.dev/skills/oleksbard/cosmobar/skill"><img src="https://agentmods.dev/badge/skills/oleksbard/cosmobar/skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.01266 |
| Opus 5 | $0.00034 | $0.00633 |
| Sonnet 5 | $0.00014 | $0.00253 |
| Haiku 4.5 | $0.00007 | $0.00127 |
Grade D, and why
cosmobar scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
`curl -sS https://raw.githubusercontent.com/oleksbard/cosmobar/main/install.sh | sh` Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
4. **Apply immediately — no preview step, no confirmation prompt.** As soon as the interview answers are in, write the config and wire it. Don't render a preview and don't put up a "shall I apply this?" question — both a Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -sS https://raw.githubusercontent.com/oleksbard/cosmobar/main/install.sh | sh` How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cosmobar guided setup
Configure cosmobar by interviewing the user, then apply the result with one command. Do not hardcode the list of segments or themes — read them live from the binary so this stays correct as cosmobar gains new segments.
Steps
-
Confirm the binary is installed. Run
cosmobar --version.- If you get "command not found", tell the user to install it first:
curl -sS https://raw.githubusercontent.com/oleksbard/cosmobar/main/install.sh | shthen stop and let them install.
- If you get "command not found", tell the user to install it first:
-
Discover what's available (dynamic — always run these, never assume):
cosmobar segments --json→ array of segments, each withname,description,default_on,requires_git,pro_max_only.cosmobar themes --json→ array of theme names.
-
Interview the user with the AskUserQuestion tool. Keep it short — group related choices:
- Segments: present every segment returned by the JSON, using its
description. Pre-select the ones wheredefault_onis true. Mention thatpro_max_onlysegments only show data on Pro/Max plans, andrequires_gitsegments only appear inside a git repo. Let the user pick the set to show. The order they end up with is the left-to-right display order. - Theme: offer the names from the themes JSON (default
coral). - Clock:
24h,12h, oroff. - Glyphs (optional):
auto(default) orascii— pickasciionly if their terminal can't render block characters like▓░. - Style:
lean(default),tick, orblocks(background pills). All styles are font-free — there is no Nerd Font / powerline option. - Caps — ask ONLY when the chosen style is
blocks:soft(default) orsquare. Forleanortick, do not ask about caps at all.AskUserQuestioncan't branch mid-batch, so put style in the first batch and send the caps question separately afterwards, only if style came backblocks. - Animation:
on(default) oroff. When on, a segment's value briefly scrambles through symbols and "decodes" into its new value whenever it changes — purely visual, width-stable. Offerofffor users who want a completely static bar. - Rate-limit window (only if
rate_limitsis enabled):both(default),5h, or7d. - Cost rollup (only if
costis enabled): show today's cross-session spend (· $5.30 today) on the cost segment —today(default) to show, empty to hide. - Block cost (only if
rate_limitsis enabled):on(default) oroff. When on, the 5-hour window shows its spend, e.g.5h 31% $4.20 (2h30m left).
- Segments: present every segment returned by the JSON, using its
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 50 lines · 68 tokens per session scan D 5cfbc760d209
cosmobar is a skill published in the GitHub repository oleksbard/cosmobar (4 stars, last pushed 2mo ago), licensed MIT. It adds 68 tokens to every session and 1,266 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
oh-my-posh
Install, configure, or troubleshoot Oh My Posh/ohmyposh: shell init, themes, segments, Nerd Font icons, and prompt setup on PowerShell, zsh, bash, or fish.
clean-windows-c-drive
Provide a standalone Simplified Chinese Windows app and CLI workflows to assess C: drive health, clean a fixed allowlist of regenerable junk, find large user files, detect exact duplicates with SHA-256, and relocate or recycle explicitly approved ordinary user files without breaking Windows or installed applications.…
powershell-docs
PowerShell 7.6 + Windows PowerShell 5.1 — variables, arrays, hashtables, functions, classes, remoting, modules, DSC.
powershell-knowledge
Comprehensive PowerShell development knowledge for scripts, modules, GUIs, and Windows automation. Use when working with: (1) PowerShell script development and best practices, (2) Function and parameter design, (3) Pipeline handling and error management, (4) Windows Forms and WPF GUI creation, (5) PowerShell Gallery…
powershell-7-expert
Use when building cross-platform cloud automation scripts, Azure infrastructure orchestration, or CI/CD pipelines requiring PowerShell 7+ with modern .NET interop, idempotent operations, and enterp...
powershell-expert
Develop PowerShell scripts, tools, modules, and GUIs following Microsoft best practices. Use when writing PowerShell code, creating Windows Forms/WPF interfaces, working with PowerShell Gallery modules, or needing cmdlet/module recommendations. Covers script development, parameter design, pipeline handling, error…