Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rcarmo/piclaw-addons --skill portainer-container-compare-chartgit clone --depth 1 https://github.com/rcarmo/piclaw-addonsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rcarmo/piclaw-addons/portainer-container-compare-chart)<a href="https://agentmods.dev/skills/rcarmo/piclaw-addons/portainer-container-compare-chart"><img src="https://agentmods.dev/badge/skills/rcarmo/piclaw-addons/portainer-container-compare-chart/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rcarmo/piclaw-addons/portainer-container-compare-chart"><img src="https://agentmods.dev/badge/skills/rcarmo/piclaw-addons/portainer-container-compare-chart.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00696 |
| Opus 5 | $0.00012 | $0.00348 |
| Sonnet 5 | $0.00005 | $0.00139 |
| Haiku 4.5 | $0.00002 | $0.00070 |
Grade A, and why
portainer-container-compare-chart scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Keep data collection in the native `portainer` tool, not direct curl scripts. How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Portainer container compare chart
Use this skill when you need a comparative chart for two containers, possibly across different endpoints.
Goal
Collect data through the native portainer tool only, then render comparison artifacts locally.
Native-tool-first collection flow
- Ensure Portainer config exists:
action: "discover"action: "set"if needed
- Resolve endpoints:
- prefer
action: "workflow", workflow: "endpoint.list" - or
action: "request", method: "GET", path: "/api/endpoints"
- prefer
- Resolve containers on each endpoint:
- prefer
container.list/container.resolve - or raw request to Docker-proxy surfaces like:
/api/endpoints/{id}/docker/containers/json?all=1
- prefer
- Fetch live stats snapshots for each container using native raw request only:
action: "request"method: "GET"path: "/api/endpoints/{id}/docker/containers/{containerId}/stats"query: { "stream": false }
- Repeat snapshot collection for a bounded sample window.
- Write a normalized input JSON file.
- Run the renderer script in this skill directory.
- Attach the SVG/CSV/JSON outputs.
Input schema for the renderer
Write JSON like this before rendering:
{
"title": "Portainer comparison: graphite vs node-red",
"subtitle": "12 live samples over ~55s via Portainer Docker stats",
"items": [
{
"endpoint": "diskstation",
"container": "graphite",
"image": "graphiteapp/graphite-statsd:latest",
"samples": [
{
"timestamp": "2026-04-05T15:00:00.000Z",
"cpu_pct": 16.4,
"mem_pct": 5.6,
"mem_usage_bytes": 1234,
"mem_limit_bytes": 5678,
"rx_bytes": 100,
"tx_bytes": 200,
"pids": 42
}
]
}
]
}
Render command
Run the renderer script adjacent to this SKILL file:
bun ./render-portainer-container-compare.ts \
--in /workspace/tmp/portainer-compare-input.json \
--out-prefix /workspace/exports/portainer-compare
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 89 lines · 24 tokens per session scan A a3f698e6bf0b
portainer-container-compare-chart is a skill published in the GitHub repository rcarmo/piclaw-addons (23 stars, last pushed yesterday), licensed MIT. It adds 24 tokens to every session and 696 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
OpenShell + Pi: build an isolated coding-agent sandbox
Use when the user wants to install, configure, migrate, harden, inspect, or troubleshoot a Pi coding agent running in NVIDIA OpenShell, especially with rootless Podman, deny-by-default networking, hidden credentials, persistent state, or A2A communication. Do not use for ordinary containerization that does not involve…
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
k8s-pod-escape
Kubernetes pod escape to node — privileged container abuse, hostPath mount escape, hostPID/hostIPC, capability misuse (SYSADMIN, SYSPTRACE), runC CVE chains. Pivots from RCE-in-pod to full node compromise.
k8s-pivot
Kubernetes attack playbook — service-account token theft, RBAC abuse, pod escape, hostPath mount abuse, kube-api-server pivoting.
container-cve
High-impact container-runtime CVE catalog — runC Leaky Vessels (CVE-2024-21626/-23651/-23652/-23653), CVE-2022-0185 (FUSE/legacy-fs), CVE-2019-5736 (runC binary replace), CRI-O Dirty COW analogs, Kubernetes API server CVE-2019-11247 (custom-resource RBAC bypass). Fingerprint → match → exploit.
container-overview
Container / Kubernetes attack category — pod escape, RBAC abuse, runtime CVE exploitation, socket-mount escape. Routing skill: identify the surface (pod-internal RCE vs API-level vs build-pipeline), then load the matching sub-skill.