Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/philipyaz/cos/spoke-setupnpx skills add philipyaz/cos --skill spoke-setupgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/spoke-setup)<a href="https://agentmods.dev/skills/philipyaz/cos/spoke-setup"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/spoke-setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00222 | $0.02611 |
| Opus 5 | $0.00111 | $0.01306 |
| Sonnet 5 | $0.00044 | $0.00522 |
| Haiku 4.5 | $0.00022 | $0.00261 |
Grade C, and why
spoke-setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsS --max-time 5 "$HUB/api/healthz" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s);console.log("hub role:",j.role,"deviceId:",j.deviceId,"schema:",j.schemaVersion)})' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsS --max-time 5 "$HUB/api/healthz" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s);console.log("hub role:",j.role,"deviceId:",j.deviceId,"schema:",j.schemaVersion)})' How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spoke setup — join this machine to an existing Cos hub
A spoke is a machine that uses an existing hub's board over the network instead of running its
own. Its board-facing MCP wrappers (board, calendar, enabled add-ons) point at the hub's
BOARD_URL; there is no local board, no cases.json, no backups here — the hub owns all state.
The store's role guard (SpokeRoleError) refuses any local write, so a spoke can never fork the
single source of truth.
This is NOT the first-machine path. The first machine is a HUB — run
cos-setup. Use this skill only to add a machine to a Cos that already exists.
Do you actually need a spoke? If you only want to VIEW / use the board UI from this machine, you need NOTHING here — open the hub's
tailscale serveURL (https://<hub>.<tailnet>.ts.net, portless HTTPS 443) in a browser and you get the full read/write UI (zero setup; the browser writes through the same HTTP API). Runspoke-setuponly to let Claude Code / Cowork ACT on the board from this machine with local MCP tools. Why a spoke and not just the URL: Cowork accepts only local stdio MCP servers (never a remote HTTP MCP over the tailnet), so a thin local wrapper pointed at the hub is the only way to hand a local agent those tools — a browser can't. VIEW it → browser; ACT with an agent → spoke.
What you need first — the join string
On the hub, open the board's Devices panel → Add a device, or run
node scripts/join-blob.mjs on the hub. Either gives a cos-join://v1?hub=…&schema=… string. It
carries the hub's tailnet URL + its store schemaVersion (+ an optional backup-repo ref) — addresses
and expectations, no secrets, so it neither expires nor needs protecting.
Also required: Tailscale installed + logged in on BOTH machines (the hub and this spoke) on the
same tailnet, and the hub serving its board over the tailnet (tailscale serve --bg 3000, so the hub
answers at https://<hub>.<tailnet>.ts.net).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 153 lines · 222 tokens per session scan C 029723f57fd8
spoke-setup is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed today), licensed MIT. It adds 222 tokens to every session and 2,611 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fcs-12-cable-tensioning
FCS-12 (2024 ed.) tensioning + inspection for type-A field cables. Use for: tension limit lookups, inspection scheduling, A1-vs-A2 distinctions, anchor-unavailable fallback.
hyperpod-version-checker
Check and compare software component versions on SageMaker HyperPod cluster nodes - NVIDIA drivers, CUDA toolkit, cuDNN, NCCL, EFA, AWS OFI NCCL, GDRCopy, MPI, Neuron SDK (Trainium/Inferentia), Python, and PyTorch. Use when checking component versions, verifying CUDA/driver compatibility, detecting version mismatches…
tik4net-mcp-install
Install, update or repair the tik4net.mcp MCP server (the mikrotikcall / mikrotikclicomplete / mikrotikdiscover tools) — either through the in-repo dev launcher or as a .NET global tool. Use when changes to Tools/tik4net.mcp/ or to tik4net itself are not showing up in the MCP tools, when the MCP server is…
rtl-property-inference
Automatically infer formal correctness properties from Verilog/SystemVerilog RTL code and generate SystemVerilog Assertions (SVA). Identifies control-flow invariants (mutual exclusion, valid-ready handshakes, pipeline ordering, safety properties), liveness expectations, and temporal properties. Use when working with…
frontend-dashboard
Use this skill when editing the embedded dashboard frontend in this repository. It focuses on preserving the single-file embedded SPA model, keeping the UI lightweight, and avoiding unnecessary frontend tooling or dependencies.
unifly
This skill should be used when the user asks to "manage UniFi devices", "configure UniFi networks", "create a VLAN", "provision an SSID", "create firewall rules", "reorder firewall policies", "create a NAT rule", "set up port forwarding", "configure masquerade NAT", "add DNS records", "manage traffic matching lists"…