Borrowing it
Nothing to install: this file belongs to philipyaz/cos. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/philipyaz/cos/main/.claude/skills/setup-vault/SKILL.mdgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/setup-vault)<a href="https://agentmods.dev/skills/philipyaz/cos/setup-vault"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/setup-vault/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/philipyaz/cos/setup-vault"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/setup-vault.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00160 | $0.06401 |
| Opus 5.5 | $0.00064 | $0.02560 |
| Sonnet 5.5 | $0.00032 | $0.01280 |
| Haiku 4.5 | $0.00016 | $0.00640 |
Grade D, and why
setup-vault scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
opened, silently recorded a **blank** id and the skill moved on: Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
echo "bridge: $(curl -s -X POST "http://127.0.0.1:$VAULT_BRIDGE_PORT/mcp" -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST "http://127.0.0.1:$VAULT_BRIDGE_PORT/mcp" \ How it starts
The opening of the file, as written. The whole thing — 348 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Set up a new private vault
What a vault is
A vault is the chief-of-staff's private knowledge base — real PII lives here (work/life notes,
entities, concepts, sources). It is knowledge-only (no to-dos, reminders, or priorities — those
live on the board). The repo ships ONE committed, synthetic template,
vault/example-vault/; a real instance is a copy at vault/<name>/ that is never committed
(durability comes from backup/, encrypted + off-site — NOT git). The vault MCP server
(mcp/vault-server/server.mjs, bridged to :8005) reads/writes exactly ONE vault, chosen by the
COS_VAULT_DIR env var in its launchd plist.
The loader (source "$(git rev-parse --show-toplevel)/config/load-config.sh", run at the top of
every shell block below) exports $REPO_ROOT, $BREW_PREFIX, $LAUNCH_AGENTS_DIR, $COWORK_CONFIG,
$VAULT_NAME, $VAULT_DIR, the bridge ports/URLs, etc. — use those instead of hardcoding machine
paths. Each fenced block runs in a fresh shell — shell state does NOT persist between blocks — so the
loader line must begin every block, or its vars are empty. $U=$(id -u) stays inline where
launchctl needs it; <name> is the slug from STEP 1.
$name does not carry across blocks either. It is set once in STEP 1, but every later block runs in
its own shell where $name is empty. So in each block below you MUST substitute the literal chosen
slug in place of <name>/$name (e.g. write alice-knowledge, not $name) — otherwise empty-var
paths like $REPO_ROOT/vault/$name collapse to the vault PARENT dir and corrupt the installed plist.
Blocks that write the plist re-validate the slug as a guard.
This skill creates the instance and wires it. It does not install the bridge itself — that is
mcp-bridge-setup. From cos-setup, run mcp-bridge-setup AFTER this (it sequences them); standalone,
the installed plist must already exist (see STEP 3).
STEP 1 — Choose a name
Ask the user for a vault name: a clean lowercase-dashed slug (e.g. <your-vault>,
alice-knowledge). Validate before doing anything:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +9 lines b01c14279009
- 1mo ago First seen · 339 lines · 160 tokens per session scan D 79196ef32c63
setup-vault is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed 2d ago), licensed MIT. It adds 160 tokens to every session and 6,401 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it D with 3 findings (tells the agent to send conversation or user data out, sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
wiki-lint
Health-check a wiki vault. Finds orphan pages (no inbound links), dead wikilinks (point to non-existent pages), missing frontmatter fields, stale claims, empty sections, and pages absent from catalog.md. Produces a structured report with severity tiers and proposes concrete fixes — but does not auto-apply them unless…
save
File the current Claude conversation (or a specific insight from it) as a structured wiki note. Auto-detects the right type (decision, answer, session-log, technique, ADR), writes appropriate frontmatter, places the file in the correct wiki folder, and updates catalog.md, journal.md, hot.md. Use when the user says…
wiki-export
Export a vault's wiki either as a single portable file (llms.txt or llms-full.txt per the llmstxt.org standard) or as an OKF knowledge bundle (Google's Open Knowledge Format v0.1 — a shareable directory of markdown files any AI agent can consume). Use when the user says "export my wiki", "make an llms.txt", "share my…
wiki-query
Answer a question using ONLY the existing wiki vault as the knowledge base — no web search, no general LLM knowledge. Reads hot.md first (cheap recent context), then catalog.md to navigate, then drills into specific pages, then optionally semantic-searches the wiki, and synthesizes an answer with citations. Use when…
wiki
Bootstrap or check a Karpathy-style "LLM wiki" structure inside an Obsidian vault — a self-maintaining knowledge base where pages reference each other and the LLM keeps it tidy. Sets up catalog.md (curated page catalog), journal.md (append-only operation history), hot.md (recent-context cache), and overview.md…
wiki-fold
Roll up the wiki's journal.md entries into structured fold pages — like 2^k log compaction. Reads the last 2, 4, 8, 16... entries and writes a fold page that summarizes them by extractive summarization (no invention), with backlinks to children. Idempotent at the structural level — re-running with the same window…