Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add paruff/uFawkesAI --skill gitops-overlaygit clone --depth 1 https://github.com/paruff/uFawkesAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/paruff/ufawkesai/gitops-overlay)<a href="https://agentmods.dev/skills/paruff/ufawkesai/gitops-overlay"><img src="https://agentmods.dev/badge/skills/paruff/ufawkesai/gitops-overlay.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.00546 |
| Opus 5 | $0.00015 | $0.00273 |
| Sonnet 5 | $0.00006 | $0.00109 |
| Haiku 4.5 | $0.00003 | $0.00055 |
Grade A, and why
gitops-overlay scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill: GitOps Overlay Validation
Load trigger:
"load gitops-overlay skill"> DORA: Cap 1 (AI Policy) Token cost: Low
Purpose
Validate GitOps overlays for correctness and compliance.
Responsibilities
- Validate kustomize builds succeed
- Validate environment overlays
- Validate image tags and digests
- Validate configmaps and secrets
Inputs
overlays/directoryversion.json
Outputs
gitops-overlay.json
Validation Rules
Kustomize Build
-
kustomize build overlays/devsucceeds -
kustomize build overlays/stagingsucceeds -
kustomize build overlays/productionsucceeds - No broken references or patches
Environment Separation
- Dev, staging, production overlays present
- Environment-specific values in patches only
- Base manifests referenced, not duplicated
- No dev-only configs leaking to production
Image Management
- Image tags immutable in production (digest-pinned)
- No
:latesttag in production - Image pull secrets referenced correctly
Secrets
- No plaintext secrets in overlays
- Secrets externalized (ExternalSecrets, SealedSecrets)
- Secret references valid
Configuration
- ConfigMaps contain non-sensitive config only
- Environment-specific values correct
- Resource limits appropriate per environment
Tools
kustomize buildfor validationyqfor YAML inspection- ArgoCD for sync validation
Output Format
{
"skill": "gitops-overlay",
"status": "pass | fail",
"overlays": {
"dev": { "build": "pass", "issues": [] },
"staging": { "build": "pass", "issues": [] },
"production": { "build": "fail", "issues": ["Image tag uses :latest"] }
},
"violations": []
}
Success Criteria
- All overlays build successfully
- Environment separation enforced
- No plaintext secrets in Git
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 96 lines · 30 tokens per session scan A c2e7d89dc413
gitops-overlay is a skill published in the GitHub repository paruff/uFawkesAI (2 stars, last pushed 14d ago), licensed MIT. It adds 30 tokens to every session and 546 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
infrastructure-publishing
Skill for the publishing infrastructure module providing academic publishing workflows including BibTeX CLI citation generation, APA/MLA citation helper functions, DOI management, Zenodo publication, arXiv submission preparation, GitHub releases, PyPI and TestPyPI package distribution, static-site deployment to GitHub…
template-publish
Publishing scripts for DOI-bearing project releases, optional mirror uploads, PyPI release validation, post-publish verification, and publication export. Use with docs/guides/publication-runbook.md for standalone GitHub + Zenodo release workflows.
template-audit
Audit and quality-gate scripts for the template research framework. Covers documentation linting, filepath audits, mock-usage checking, template drift, and confidentiality / git-guard checks.
infrastructure-docker
Container build and compose assets for the research template. Use when reproducing CI or cloud environments with Docker, following docs/CLOUDDEPLOY.md, or wiring Ollama sidecars via docker-compose.
worktree
Set up parallel agent sessions on independent tasks via git worktrees. Use when asked to '/worktree', 'git worktree', 'parallel branches', 'isolated branch workspace', 'work on two things at once'.
ship
Use when a change is ready to land. Runs the full sequence — branch, quality gate, commit, push, PR — so nothing gets skipped.