Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add philipyaz/cos --skill unanswered-messagesgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/unanswered-messages)<a href="https://agentmods.dev/skills/philipyaz/cos/unanswered-messages"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/unanswered-messages/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/philipyaz/cos/unanswered-messages"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/unanswered-messages.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 57 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 65 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.11970 |
| Opus 5 | $0.00063 | $0.05985 |
| Sonnet 5 | $0.00025 | $0.02394 |
| Haiku 4.5 | $0.00013 | $0.01197 |
Grade A, and why
unanswered-messages scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
It writes to the board **only** through the **`board`** MCP — never `bash`/`curl` How it starts
The opening of the file, as written. The whole thing — 637 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Unanswered messages (the reply-owed sweep)
This skill finds the messages you still owe a reply to — across WhatsApp and Gmail — and records each one on the board's Unanswered surface, then marks it answered once you've replied. A message that just needs a reply (no document to chase, no meeting to book, no project behind it) generates no case, no reminder, no event today — so it silently slips through every other sweep. This is the surface that catches exactly those.
It writes to the board only through the board MCP — never bash/curl
(Cowork's sandbox blocks outbound HTTP; the tools exist for exactly this). It uses
only the READ tools of the whatsapp and Gmail MCPs: it never sends or
drafts a message on either channel — no send_message, send_file,
send_audio_message, no Gmail draft/send. It tracks that a reply is owed; you reply,
in WhatsApp or Gmail, and the next sweep notices and clears it.
An unanswered message is not a new entity and not a reminder — it is the
existing MessageRecord carrying a status flag. The predicate is exactly
needsAnswer === true && !answeredAt; marking answered sets answeredAt = now,
and the row leaves the view because the predicate no longer holds (it does not
cascade to a reminder, a lane, or a task). A message can be linked to a case, to a
reminder, or to nothing (standalone) — and still be flagged unanswered.
The headline guardrail. The board is a shared surface: the human edits it by hand in the UI, the agent flags/clears via this skill. The user can mark a message answered by hand (the Unanswered panel's "Mark answered" button) — never reopen one a human cleared, and never flag a message the user has plainly already dealt with. The Mark-answered rule (below) is the contract; read it before any write.
The JID gotcha — keep it visible the whole sweep. WhatsApp identifies a chat in three forms: a DM is
<phone>@s.whatsapp.net, a group is<id>@g.us, and an anonymous link-id is<id>@lid. The same person can appear as both a@s.whatsapp.netphone and a@lid— most "this person has two cards" / "I recorded the same reply-owed twice" bugs trace back to not collapsing those two forms (dedup + identity resolution, below). Always think about which form you're holding.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 637 lines · 125 tokens per session scan A bff76613945e
unanswered-messages is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed 2d ago), licensed MIT. It adds 125 tokens to every session and 11,970 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
meta-sync-template
Interactive flow to propagate the reference (.template) vault's plugins, snippets, and root docs to one or more configured vaults. Reads the active router config, lists every vault with online status, flags vaults missing obsidian-local-rest-api upfront, lets the user pick all or a subset, and optionally re-clones…
write-bundle
Run several vault writes as ONE logical operation with rollback — the note + the index + the journal + hot.md either all land, or none do. Use whenever a single user-visible action touches 2+ files and a half-written result would be wrong. Also the recovery entry point for bundles a crash left unfinished. EN triggers…
canvas
Create or modify Obsidian canvas (.canvas) files — visual layout layer where wiki pages, images, PDFs, and free-form text cards are arranged spatially. Supports adding nodes, defining zones (labeled regions), and laying out content with auto-positioning. Use when the user says "create a canvas", "add to canvas"…
write-frontmatter-merge
Apply multiple frontmatter updates at once (sequential, NOT atomic — partial failures are reported per-key). Use when you want to update 2+ properties on the same file in one call. EN triggers: "update multiple properties on X", "set status, score, and tags on X", "mark Y as closed with outcome stopped", "bulk-update…
template-execute
Execute a Templater template, optionally writing the rendered output to a new file. Arguments are exposed to the template via tp.mcpTools.prompt("key") (directly under tp, NOT under tp.user — easy footgun). EN triggers: "render the X template", "run the daily template", "execute Templates/X.md with arg1=v1", "use…
read-search
Plain-text (substring) search inside a vault, with surrounding context. EN triggers: "find in my vault", "search for the literal string X", "grep for X", "where do I mention X", "find files containing X". FR triggers : "trouve dans mon vault", "cherche la chaîne X littéralement", "grep ", "où est-ce que je mentionne…