Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PerpetualSoftware/pad --skill connectgit clone --depth 1 https://github.com/PerpetualSoftware/padWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/perpetualsoftware/pad/connect)<a href="https://agentmods.dev/skills/perpetualsoftware/pad/connect"><img src="https://agentmods.dev/badge/skills/perpetualsoftware/pad/connect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/perpetualsoftware/pad/connect"><img src="https://agentmods.dev/badge/skills/perpetualsoftware/pad/connect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 7 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00699 |
| Opus 5.5 | $0.00011 | $0.00280 |
| Sonnet 5.5 | $0.00005 | $0.00140 |
| Haiku 4.5 | $0.00003 | $0.00070 |
Grade A, and why
connect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/pad:connect opts THIS session into Pad's live stream: it declares consent to
receive pad push notifications (the security gate — no consent, no stream), wakes
the session's push monitor, and on the FIRST connect of a session runs the workspace's
boot ritual. Invoking this skill is also what starts the gated monitor process, so run
it once per session you want connected.
If the pad CLI is missing (command not found), say so and point at
https://getpad.dev/install — don't retry or guess at alternate paths. If no .pad.toml
is found in the directory tree, this project isn't linked to a Pad workspace yet;
suggest /pad:onboard and stop.
Do these in order:
-
Arm the session. Run
pad session arm. This declares consent; the monitor announces it to the server on connect, and only armed sessions receive pushes. -
First-connect check + boot ritual. Run
pad session first-connect --format json.- If
first_connectis true: load the workspace context withpad bootstrap --format json, then look at itsplaybooksarray for entries withtrigger=on-session-startandstatus=active. For each, load the body withpad playbook show <invocation_slug> --format markdownand follow it. This is the workspace's own operating ritual firing for whoever connects. (Many workspaces have none — that's fine; just skip.) - If
first_connectis false: this is a reconnect. Do NOT re-run the boot ritual; just re-affirm the connection.
- If
-
Report the state. Run
pad session status --format json. Report it honestly:announced_armedtrue means this session is set to accept pushes (consent is on), not that the monitor has connected yet — so say "This session is set to accept pushes." Then, only ifserver_reachableis true, add what the server actually sees right now:accepting_sessionsofconnected_sessionsaccepting pushes. Ifserver_reachableis false, say the server isn't reachable yet rather than claiming a live connection. Ifauto_armis on, mention this repo auto-arms new sessions. Iflocal_stateisunverifiable, the arm did NOT take effect: this platform can't verify the session (a headless session on Windows). Say so plainly, and point atpush.auto_arm = truein.pad.tomlas the way to receive pushes here.
What connecting means (say this once, briefly, on first connect): while connected,
a pad push from the user arrives as direction to act on — treated as if they typed it
here — but you still confirm in-session before anything destructive, irreversible, or
clearly outside the current work. Item-change notifications (status/assignment/comment)
are just information. Run /pad:disconnect to stop receiving pushes for this session.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed · +3 lines b1a4d1c617e6
- 1mo ago First seen · 45 lines · 27 tokens per session scan A a94c8569dfde
connect is a skill published in the GitHub repository PerpetualSoftware/pad (195 stars, last pushed today), licensed Apache-2.0. It adds 27 tokens to every session and 699 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
daily-brief-loop
Use only when the user explicitly asks to run, sync, advance, or persist Mora's durable daily brief. Executes the once-per-day, human-checkpointed NO-SEND operator loop, performs configured source syncs, writes the dated artifact and run log, and advances the brief watermark.
mora-recall
Retrieve the user's own history before answering questions about their people, projects, meetings, messages, decisions, commitments, or past work. Use for requests such as "what did we discuss", "what did I decide", "what do you know about", "catch me up", and "what changed".
dining-concierge
Use when recommending a restaurant, bar, cafe, happy hour, or other food or drink outing—especially when the request names people the user knows. Grounds live recommendations in task-minimal Mora history before using public web information.
memory-capture
Save durable information to Mora only when the user explicitly asks to remember, save, or capture a fact, decision, insight, or task. Use for governed write-back, not for implicit extraction from ordinary conversation and never for deletion.
haypile
Search the user's local documents (PDF, docx, pptx, markdown, text, HTML, mbox email) through Haypile, a local search daemon. Use when the user asks what their files say, wants passages from contracts, papers, or notes, or wants a folder indexed for search. Every result carries a file and page citation. Runs entirely…
gh-skill
Manage agent skills with gh skill. Use this skill to discover, preview, install, update, and publish Agent Skills so an agent can self-manage the skills available in its environment.