Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ppiankov/pastewatch --skill docsgit clone --depth 1 https://github.com/ppiankov/pastewatchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ppiankov/pastewatch/docs)<a href="https://agentmods.dev/skills/ppiankov/pastewatch/docs"><img src="https://agentmods.dev/badge/skills/ppiankov/pastewatch/docs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ppiankov/pastewatch/docs"><img src="https://agentmods.dev/badge/skills/ppiankov/pastewatch/docs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 131 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 524 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Rogue Agent · line 217 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Privilege Escalation · line 476 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 478 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 481 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 484 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.06704 |
| Opus 5.5 | $0.00006 | $0.02682 |
| Sonnet 5.5 | $0.00003 | $0.01341 |
| Haiku 4.5 | $0.00002 | $0.00670 |
Grade B, and why
pastewatch scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks the agent to reveal its instructionsmediumSystem prompt leakage
Directions to print, repeat or translate the system prompt extract configuration the operator did not intend to expose.
To verify whether a value would be blocked or redacted, pipe it to `check`; never pass secrets as arguments. Input is stdin or `--file` only. Interactive stdin uses a no-echo prompt. Shell literals in examples are placeh How it starts
The opening of the file, as written. The whole thing — 618 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pastewatch-cli
Sensitive data scanner. Deterministic regex-based detection and obfuscation for text content. No ML, no network calls.
For AI agent setup with secret redaction, see agent-integration.md.
Install
brew install ppiankov/tap/pastewatch
Configuration
Config files
| File | Location | Purpose | Created By |
|---|---|---|---|
/etc/pastewatch/config.json |
System | Administrator-pinned config; highest precedence | Administrator |
.pastewatch.json |
Project root ($CWD) |
Project-level config | pastewatch-cli init |
~/.config/pastewatch/config.json |
Home | User-level defaults | Manual / GUI app |
.pastewatch-allow |
Project root | Value allowlist (one per line, # comments) |
pastewatch-cli init |
.pastewatchignore |
Project root | Path exclusion patterns (glob, like .gitignore) |
Manual |
.pastewatch-baseline.json |
Project root | Known findings baseline (SHA256 fingerprints) | pastewatch-cli baseline create |
File targets automatically load one .pastewatch-allow from their Git toplevel,
or the explicit non-Git scan/watch root (single-file operations use the parent).
Its exact entries suppress advisory classes only, never non-ambiguous types,
custom rules or intrinsic/exact-known-secret evidence. The same restriction
applies to project config and tighten-only user entries. Stdin and raw MCP text load no project allow file. doctor --explain
reports the resolved path, loading status and effective/ignored entry counts.
Resolution cascade
Administrator policy, or user policy when no system config exists, merges with tighten-only subordinate contributions; defaults apply when operator policy is absent. Types, rules, obfuscation and protected paths accumulate, rule severities cannot decrease, and subordinate suppression patterns are ignored. Subordinate mcpMinSeverity may only decrease to report more advisories. Intrinsic exemptions require exact whole values in the authoritative operator tier, never project files or patterns. Agents cannot create or modify .pastewatch.json or .pastewatch-allow. Run pastewatch-cli doctor --explain for per-field tier attribution; follow Troubleshooting.
What ships with it
26 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agent-integration.md 19 KB
- agent-safety.md 17 KB
- agent-setup.md 14 KB
- CLAUDE-SNIPPET.md 2.7 KB
- cli-reference.md 53 KB
- examples/claude-code/pastewatch-guard.sh 4.3 KB runs code
- examples/claude-code/settings.json 396 B
- examples/cline/mcp-config.json 178 B
- examples/cline/pastewatch-hook.sh 3.8 KB runs code
- examples/cursor/mcp.json 153 B
- examples/cursor/pastewatch-guard.sh 2.3 KB runs code
- examples/pastewatch.json 594 B
- examples/README.md 10 KB
- examples/roo-code/mcp-config.json 178 B
- examples/roo-code/pastewatch-hook.sh 3.8 KB runs code
- exemptions.md 6.2 KB
- hard-constraints.md 3.3 KB
- proxy-invariants.md 5.3 KB
- release.md 1.5 KB
- research/agy-hallucinated-hooks.md 5.6 KB
- research/agy-hooks-discovery.md 8.2 KB
- research/agy-hooks-follow-up.md 8.3 KB
- research/gh-multi-account-macos.md 4.5 KB
- startup-sweep.md 2.3 KB
- status.md 9.3 KB
- troubleshooting.md 9.7 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -1 lines e05e60ebbf52
- 7d ago Changed · +15 lines 988100810a91
- 12d ago Changed · +50 lines scan A → B d5e57f381029
- 1mo ago First seen · 554 lines · 16 tokens per session scan A 63c0c9f28ef4
pastewatch is a skill published in the GitHub repository ppiankov/pastewatch (6 stars, last pushed yesterday), licensed MIT. It adds 16 tokens to every session and 6,704 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks the agent to reveal its instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
claudexor
Use the local Claudexor control plane for harness-agnostic coding work across Claude Code, Codex, Cursor, and OpenCode. Use when a task benefits from route-aware harness and account selection, quota-aware account rotation, shared thread context, read-only planning or research, best-of-N execution, or cross-harness…
findmy
Query Find My friend locations on macOS via the findmy-cli plugin tools. Returns name, coarse location (city, state), staleness, and distance for everyone in the FindMy.app People sidebar. Use when the user asks "where is X", "is X home", "how far is X", or wants a location refresh.
macvis
On-device, zero-token vision for AI agents (mac-local-vision, macOS). Read text from an image / screenshot / PDF (OCR), find the exact click-pixel of a word for E2E/UI assertions, scan QR codes and barcodes, tag/classify an image, group photos by face, flatten a photographed document, extract a document's structured…
agent-computer-use
REQUIRED for any task that involves operating a desktop application — opening apps, clicking buttons, typing into fields, pressing keys, scrolling, dragging, reading what's on screen, moving or resizing windows, or verifying state after an action. Always use the agent-cu CLI commands (open, snapshot, click, type, key…
use-peek
Use the peek CLI to inspect, debug, and interact with native macOS app windows. Use when the user asks to debug a macOS app, inspect UI elements, take screenshots, click buttons, or automate interactions with native apps.
rem-cli
Create, list, update, complete, tag, and search macOS Reminders via the rem CLI. Use when the user wants to manage Apple Reminders from the terminal, automate reminder workflows, reference reminders in shell scripts, or schedule anything on macOS.