Borrowing it
Nothing to install: this file belongs to rjwalters/kicad-tools. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rjwalters/kicad-tools/main/.agents/skills/loom-comment-body-literal-path/SKILL.mdgit clone --depth 1 https://github.com/rjwalters/kicad-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rjwalters/kicad-tools/loom-comment-body-literal-path)<a href="https://agentmods.dev/skills/rjwalters/kicad-tools/loom-comment-body-literal-path"><img src="https://agentmods.dev/badge/skills/rjwalters/kicad-tools/loom-comment-body-literal-path/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rjwalters/kicad-tools/loom-comment-body-literal-path"><img src="https://agentmods.dev/badge/skills/rjwalters/kicad-tools/loom-comment-body-literal-path.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01362 |
| Opus 5.5 | $0.00008 | $0.00545 |
| Sonnet 5.5 | $0.00004 | $0.00272 |
| Haiku 4.5 | $0.00002 | $0.00136 |
Grade A, and why
loom-comment-body-literal-path scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
--body @path Does NOT Expand — It Posts the Literal String (canonical)
Single canonical copy; role prompts' short pointers refer here.
If a comment/review body you're posting (via gh issue comment, gh pr comment, or gh api ... comments) lives in a scratch/scratchpad file, do not
pass it as --body @path. Unlike some shells' @file conventions, gh pr comment --body @path and gh issue comment --body @path do not read the
file — they post the literal text @path as the comment. A real incident (PR
#4457) lost an entire changes-requested review this way (the body was the
string @/private/tmp/.../review.md; the file was overwritten before anyone
caught it). It recurred again later via gh api ... -f body=@path
(-f/--raw-field never expands @path either) — see #5252. The stdin
spelling fails identically: --body @- and -f body=@- post the literal @-
(#9258: a PR merged on an approval whose whole body was @-). Only gh api ... -F body=@- reads stdin; post-verdict.sh takes --body-file -.
❌ POSTS THE LITERAL STRING "@path" — NOT THE FILE CONTENTS
gh pr comment 123 --body @/tmp/review-123.md
gh pr comment 123 --body "@/tmp/review-123.md"
gh issue comment 123 --body @/tmp/comment-123.md
gh pr comment 123 --body @- (stdin spelling: still the literal "@-")
❌ ALSO POSTS THE LITERAL STRING — a variable does NOT change what the flag does
REVIEW_FILE="@/tmp/review-123.md"; gh pr comment 123 --body "$REVIEW_FILE"
❌ ALSO POSTS THE LITERAL STRING — on `gh api`, only -F/--field expands @path
gh api repos/{owner}/{repo}/issues/123/comments -f body=@/tmp/review-123.md
✅ USE ONE OF THESE INSTEAD
gh pr comment 123 --body "$(cat <<'EOF'
... review prose ...
EOF
)"
gh pr comment 123 --body-file /tmp/review-123.md
gh api repos/{owner}/{repo}/issues/123/comments -F body=@/tmp/review-123.md
Prefer the heredoc for a short/dynamic body and --body-file <path> for one
that lives in a file (gh api ... -F body=@path also reads it; -f does
not). --body/-b takes literal text only. After posting, re-fetch the
comment (gh pr view <number> --comments) to confirm it renders your prose,
not a path string.
Why <<'EOF' must stay quoted: .loom/docs/comment-body-heredoc-quoting.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · -1 lines · -30 tokens per session 351a0d573759
- 24d ago First seen · 94 lines · 49 tokens per session scan A a876da413917
loom-comment-body-literal-path is a skill published in the GitHub repository rjwalters/kicad-tools (70 stars, last pushed today), licensed MIT. It adds 19 tokens to every session and 1,362 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.
Other skills, from other repositories
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
release-helper
Ensures configuration and code changes are released correctly. Use PROACTIVELY whenever you edit config.json, change any setting, or fix a configuration bug in this project, so the change reaches production.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…