Borrowing it
Nothing to install: this file belongs to philipyaz/cos. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/philipyaz/cos/main/.claude/skills/spoke-setup/SKILL.mdgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/spoke-setup)<a href="https://agentmods.dev/skills/philipyaz/cos/spoke-setup"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/spoke-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/philipyaz/cos/spoke-setup"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/spoke-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00222 | $0.02611 |
| Opus 5.5 | $0.00089 | $0.01044 |
| Sonnet 5.5 | $0.00044 | $0.00522 |
| Haiku 4.5 | $0.00022 | $0.00261 |
Grade C, and why
spoke-setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsS --max-time 5 "$HUB/api/healthz" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s);console.log("hub role:",j.role,"deviceId:",j.deviceId,"schema:",j.schemaVersion)})' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsS --max-time 5 "$HUB/api/healthz" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s);console.log("hub role:",j.role,"deviceId:",j.deviceId,"schema:",j.schemaVersion)})' How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spoke setup — join this machine to an existing Cos hub
A spoke is a machine that uses an existing hub's board over the network instead of running its
own. Its board-facing MCP wrappers (board, calendar, enabled add-ons) point at the hub's
BOARD_URL; there is no local board, no cases.json, no backups here — the hub owns all state.
The store's role guard (SpokeRoleError) refuses any local write, so a spoke can never fork the
single source of truth.
This is NOT the first-machine path. The first machine is a HUB — run
cos-setup. Use this skill only to add a machine to a Cos that already exists.
Do you actually need a spoke? If you only want to VIEW / use the board UI from this machine, you need NOTHING here — open the hub's
tailscale serveURL (https://<hub>.<tailnet>.ts.net, portless HTTPS 443) in a browser and you get the full read/write UI (zero setup; the browser writes through the same HTTP API). Runspoke-setuponly to let Claude Code / Cowork ACT on the board from this machine with local MCP tools. Why a spoke and not just the URL: Cowork accepts only local stdio MCP servers (never a remote HTTP MCP over the tailnet), so a thin local wrapper pointed at the hub is the only way to hand a local agent those tools — a browser can't. VIEW it → browser; ACT with an agent → spoke.
What you need first — the join string
On the hub, open the board's Devices panel → Add a device, or run
node scripts/join-blob.mjs on the hub. Either gives a cos-join://v1?hub=…&schema=… string. It
carries the hub's tailnet URL + its store schemaVersion (+ an optional backup-repo ref) — addresses
and expectations, no secrets, so it neither expires nor needs protecting.
Also required: Tailscale installed + logged in on BOTH machines (the hub and this spoke) on the
same tailnet, and the hub serving its board over the tailnet (tailscale serve --bg 3000, so the hub
answers at https://<hub>.<tailnet>.ts.net).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 153 lines · 222 tokens per session scan C 029723f57fd8
spoke-setup is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed 2d ago), licensed MIT. It adds 222 tokens to every session and 2,611 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
neuroskill-bci
Use live BCI cognitive and mood state from NeuroSkill.
wearables_comms
Required for wearable-originated calls and text messages: resolve recipients for new calls and messages, and immediately answer, decline, or cancel calls on the originating wearable instead of silently switching to a paired phone.
philips_hue
Control Philips Hue smart lights, rooms, scenes, and devices via the Hue Remote API v2.
tessie
Monitor a Tesla vehicle, inspect live state, and run explicit Tessie command endpoints.
spark-environment-setup
Set up a working ML training/inference environment on NVIDIA DGX Spark (GB10, aarch64, CUDA 13). Use when installing PyTorch/Unsloth/TRL/vLLM on DGX Spark, hitting libcudart or wheel-ABI errors on aarch64, or choosing between NGC containers and bare pip installs.
spark-training-gotchas
Preflight and diagnose the ten known failure modes for ML training on NVIDIA DGX Spark. Use when a training run on DGX Spark fails to start, OOMs below the 128GB limit, slows down mid-run, or before any multi-hour training job on GB10.