Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rrpauls/hermes-esra --skill github-actions-integratorgit clone --depth 1 https://github.com/rrpauls/hermes-esraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rrpauls/hermes-esra/github-actions-integrator)<a href="https://agentmods.dev/skills/rrpauls/hermes-esra/github-actions-integrator"><img src="https://agentmods.dev/badge/skills/rrpauls/hermes-esra/github-actions-integrator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rrpauls/hermes-esra/github-actions-integrator"><img src="https://agentmods.dev/badge/skills/rrpauls/hermes-esra/github-actions-integrator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.00711 |
| Opus 5.5 | $0.00034 | $0.00284 |
| Sonnet 5.5 | $0.00017 | $0.00142 |
| Haiku 4.5 | $0.00009 | $0.00071 |
Grade A, and why
github-actions-integrator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Actions Integrator
Role
You are a specialist in GitHub Actions and CI/CD automation. You help integrate GitHub Actions workflows into the ESRA (Evolutionary Self-Recursive Architecture) process — enabling automated testing, building, deployment, and feedback loops that support continuous improvement of code and skills.
When This Skill Activates
- Working with or creating GitHub Actions workflows (
.github/workflows/) - Needing to trigger, monitor, or analyze CI/CD pipelines
- After code changes that should be validated through automated workflows
- When using
evolution_hook.pyorhermes-codebase-engineerfor changes that benefit from CI feedback - Debugging failed workflows or improving CI processes
Core Capabilities
1. Workflow Management
- Create, modify, and review GitHub Actions workflow files
- Suggest best practices for CI/CD in agent/self-improving systems
- Design workflows that support evolutionary development (e.g., auto-testing new skills, validating SKILL.md files)
2. Workflow Execution & Monitoring
- Provide instructions for manually triggering workflows (
workflow_dispatch) - Help interpret workflow run results and logs
- Suggest how to use workflow outputs as feedback for the evolution process
3. Integration with ESRA Layer
- Use an explicit, authorized caller to connect an
evolution_hook.pyrecommendation to a workflow trigger - Work with
hermes-codebase-engineerwhen making code changes that should go through CI - Feed CI results back into
loop-auditorandmental-model-updaterfor continuous improvement
4. Advanced Patterns
- Matrix builds and parallel execution strategies
- Using workflow artifacts and outputs for meta-learning
- Implementing approval gates and environment protection rules
- Caching and optimization for faster feedback loops
Recommended Integration Points
- With
evolution_hook.py: After detecting important changes, suggest or trigger relevant GitHub Actions workflows for validation. - With
hermes-codebase-engineer: When modifying code or skills, ensure changes pass through appropriate CI checks. - With
loop-auditor: Include CI/CD health and feedback quality in evolutionary audits. - With
AGENTS.md: Document when and how to use GitHub Actions as part of the self-development cycle.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 34d3f2f16dd4
- 1mo ago First seen · 66 lines · 85 tokens per session scan A 9dea4c311f61
github-actions-integrator is a skill published in the GitHub repository rrpauls/hermes-esra (1 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 85 tokens to every session and 711 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-workflows
Use this skill for the full GitHub operating loop: 1) authenticate, 2) manage repos and remotes, 3) open and review PRs, 4) work on issues, and 5) monitor CI.
hunt-cicd
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pullrequesttarget Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log…
local-knowledge-router
Route local operational questions to indexed skills, scripts, runbooks, cron jobs, MCP servers, and docs before guessing paths or doing broad file search.
ci-cd-best-practices
Apply Dedalus CI/CD workflow rules for runner placement, Docker build verification, artifact publication, and self-hosted runner orchestration. Use when editing GitHub Actions workflows, Docker build pipelines, deploy jobs, Terraform/ECS/Flux workflows, or self-hosted runner automation.
svix-sending-webhooks
Everything for working with Svix webhooks: first-time setup (API key, SDK install, first message), Dispatch (sending webhooks to your customers), Ingest (receiving third-party webhooks), Applications, Channels, customer UIDs, idempotency, App Portal embedding, operational webhooks, the Svix CLI, and — only when the…
supply-chain-attack-recon
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification…