Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pauldatta/gemini-cli-scanner --skill env-scannergit clone --depth 1 https://github.com/pauldatta/gemini-cli-scannerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pauldatta/gemini-cli-scanner/env-scanner)<a href="https://agentmods.dev/skills/pauldatta/gemini-cli-scanner/env-scanner"><img src="https://agentmods.dev/badge/skills/pauldatta/gemini-cli-scanner/env-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pauldatta/gemini-cli-scanner/env-scanner"><img src="https://agentmods.dev/badge/skills/pauldatta/gemini-cli-scanner/env-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.01527 |
| Opus 5.5 | $0.00040 | $0.00611 |
| Sonnet 5.5 | $0.00020 | $0.00305 |
| Haiku 4.5 | $0.00010 | $0.00153 |
Grade A, and why
env-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Environment Scanner Skill
Runs gemini-cli-scanner (v3.5.6) to audit the user's AI coding tool ecosystem.
When to Activate
- User asks to "scan my environment", "analyze my setup", or "audit my tools"
- User wants to know what skills, MCP servers, extensions, or agents they have
- User wants to discover usage patterns from conversation history
- User wants a maturity score or environment report
- User asks about memory configuration, policy governance, or skill extraction
- User mentions "tribal knowledge", "pattern discovery", "skill suggestions", or "ecosystem audit"
Running the Scanner
Use ${extensionPath} to reference the scanner directory.
Quick scan (no API needed)
node ${extensionPath}/scanner.js --output-dir ./scan-results --skip-suggestions
Full scan with AI skill suggestions
Requires GOOGLE_API_KEY or GOOGLE_CLOUD_PROJECT. Uses evidence-gated two-stage pipeline: flash-lite identifies patterns, pro writes SKILL.md files in parallel.
node ${extensionPath}/scanner.js --output-dir ./scan-results
With repo discovery
node ${extensionPath}/scanner.js --output-dir ./scan-results --repos ~/Code
node ${extensionPath}/scanner.js --output-dir ./scan-results --repos ~/Code --repo-depth 4
node ${extensionPath}/scanner.js --output-dir ./scan-results --repos ~/Code/project-a ~/Code/project-b
Filter by time
node ${extensionPath}/scanner.js --output-dir ./scan-results --chat-days 30
node ${extensionPath}/scanner.js --output-dir ./scan-results --json-only
All flags
| Flag | Default | Purpose |
|---|---|---|
--version, -v |
— | Show version |
--gemini-dir PATH |
~/.gemini |
Gemini config dir |
--home-dir PATH |
~ |
Home dir for ecosystem scanning |
--output-dir PATH |
./scan-results |
Output directory |
--repos PATH [PATH..] |
[] |
Repo paths or parent dirs |
--repo-depth N |
3 |
Max recursive discovery depth |
--chat-days N |
all | Limit to last N days of history |
--skip-suggestions |
false |
Skip AI suggestions |
--json-only |
false |
JSON only, no markdown |
--include-prompts |
false |
Include raw prompts, topics, project names in manifest |
--skip-update-check |
false |
Skip GitHub version check |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 124 lines · 101 tokens per session scan A f8984c97e1e1
env-scanner is a skill published in the GitHub repository pauldatta/gemini-cli-scanner (2 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 101 tokens to every session and 1,527 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
market-skill
The main marketing skill. Teaches AI how to produce high-quality marketing assets from scratch. Covers visual direction, motion design, copywriting, platform strategy, and brand identity. For Remotion videos, Nano Banana graphics, Substack headers, X posts, LinkedIn, and product launches. Stops the AI from producing…
copy-skill
Copywriting for technical founders. Covers X posts, X threads, Substack editions, LinkedIn posts, product launch captions, and README headlines. Teaches AI to write with the directness of a senior operator and the specificity of an engineer. Stops AI from producing generic marketing copy that sounds like everyone else…
nano-banana-skill
Nano Banana image generation for marketing assets. Artist-level visual direction for brand graphics, thumbnails, Substack covers, X post backgrounds, and LinkedIn headers. Covers prompt architecture, lighting direction, composition rules, style consistency, and what to never generate. Stops AI from producing generic…
remotion-skill
Remotion video composition for marketing. Teaches AI to write Apple-quality motion in React/TypeScript. Covers spring physics, composition architecture, frame timing, text reveal patterns, and platform-specific output. For X posts, Substack headers, LinkedIn launches, and product demos. Stops AI from writing flat…
launch-skill
Product launch playbook for indie devs and technical founders. Covers asset sequencing, timing, platform order, community posting strategy, GitHub presence, and the 48-hour launch window. For ystack, Focused AI, Lumina, and Standard Bio. launches. Stops AI from producing generic "launch day" checklists that ignore…
local-places
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.