Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/philipyaz/cos/setup-vaultnpx skills add philipyaz/cos --skill setup-vaultgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/setup-vault)<a href="https://agentmods.dev/skills/philipyaz/cos/setup-vault"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/setup-vault.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00160 | $0.06300 |
| Opus 5 | $0.00080 | $0.03150 |
| Sonnet 5 | $0.00032 | $0.01260 |
| Haiku 4.5 | $0.00016 | $0.00630 |
Grade D, and why
setup-vault scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
opened, silently recorded a **blank** id and the skill moved on: Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
echo "bridge: $(curl -s -X POST "http://127.0.0.1:$VAULT_BRIDGE_PORT/mcp" -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST "http://127.0.0.1:$VAULT_BRIDGE_PORT/mcp" \ How it starts
The opening of the file, as written. The whole thing — 339 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Set up a new private vault
What a vault is
A vault is the chief-of-staff's private knowledge base — real PII lives here (work/life notes,
entities, concepts, sources). It is knowledge-only (no to-dos, reminders, or priorities — those
live on the board). The repo ships ONE committed, synthetic template,
vault/example-vault/; a real instance is a copy at vault/<name>/ that is never committed
(durability comes from backup/, encrypted + off-site — NOT git). The vault MCP server
(mcp/vault-server/server.mjs, bridged to :8005) reads/writes exactly ONE vault, chosen by the
COS_VAULT_DIR env var in its launchd plist.
The loader (source "$(git rev-parse --show-toplevel)/config/load-config.sh", run at the top of
every shell block below) exports $REPO_ROOT, $BREW_PREFIX, $LAUNCH_AGENTS_DIR, $COWORK_CONFIG,
$VAULT_NAME, $VAULT_DIR, the bridge ports/URLs, etc. — use those instead of hardcoding machine
paths. Each fenced block runs in a fresh shell — shell state does NOT persist between blocks — so the
loader line must begin every block, or its vars are empty. $U=$(id -u) stays inline where
launchctl needs it; <name> is the slug from STEP 1.
$name does not carry across blocks either. It is set once in STEP 1, but every later block runs in
its own shell where $name is empty. So in each block below you MUST substitute the literal chosen
slug in place of <name>/$name (e.g. write alice-knowledge, not $name) — otherwise empty-var
paths like $REPO_ROOT/vault/$name collapse to the vault PARENT dir and corrupt the installed plist.
Blocks that write the plist re-validate the slug as a guard.
This skill creates the instance and wires it. It does not install the bridge itself — that is
mcp-bridge-setup. From cos-setup, run mcp-bridge-setup AFTER this (it sequences them); standalone,
the installed plist must already exist (see STEP 3).
STEP 1 — Choose a name
Ask the user for a vault name: a clean lowercase-dashed slug (e.g. <your-vault>,
alice-knowledge). Validate before doing anything:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 339 lines · 160 tokens per session scan D 79196ef32c63
setup-vault is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed today), licensed MIT. It adds 160 tokens to every session and 6,300 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it D with 3 findings (tells the agent to send conversation or user data out, sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
wiki-retrieve
Build and query a vault-local contextual BM25 retrieval index with optional multilingual Nomic cosine reranking; use for retrieve, hybrid retrieval, BM25, rerank, contextual retrieval, chunk search, vault search, semantic search, find relevant passages, or retrieval diagnostics. Derived caches stay under .vault-meta…
obsidian-bases
Explain, draft, and validate Obsidian Bases .base files with filters, formulas, properties, summaries, and table, card, or list views. Use for Obsidian Bases, database-like vault views, dynamic tables, reading lists, task trackers, filters, formulas, summaries, and .base file edits.
qmd
Search the vault using QMD semantic search. Use PROACTIVELY before reading files. Preference order: (1) MCP tools — mcpqmdquery, mcpqmdget, mcpqmdmultiget, mcpqmdstatus — if they appear in your tool menu, use them first; (2) CLI qmd --index ... as fallback; (3) Grep/Glob only when QMD is not installed. Trigger…
okf
Author, maintain, and consume Open Knowledge Format (OKF) knowledge bundles — portable markdown + YAML frontmatter that both humans and agents read. Use when capturing project knowledge (services, APIs, schemas, metrics, runbooks, decisions) into an OKF bundle, when updating one after code or docs change, or when a…
shodh-memory
Persistent memory system for AI agents. Use this skill to remember context across conversations, recall relevant information, and build long-term knowledge. Activate when you need to store decisions, learnings, errors, or context that should persist beyond the current session.
vault-health-batch
Autonomous batch mode for Vault Health findings. Works through orphans, missing backlinks, and tags in batches without asking on every fix.