Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add saffron-health/libretto --skill push-everythinggit clone --depth 1 https://github.com/saffron-health/librettoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/saffron-health/libretto/push-everything)<a href="https://agentmods.dev/skills/saffron-health/libretto/push-everything"><img src="https://agentmods.dev/badge/skills/saffron-health/libretto/push-everything.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.01018 |
| Opus 5 | $0.00016 | $0.00509 |
| Sonnet 5 | $0.00006 | $0.00204 |
| Haiku 4.5 | $0.00003 | $0.00102 |
Grade A, and why
push-everything scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- push — 86% identical, 12 lines differ
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Branch handling
If on main, checkout a new branch first.
If on a non-main branch where the existing PR is already merged, the uncommitted changes are likely unrelated to that branch. In this case:
- Checkout main and pull
- Create a new branch with a name describing the uncommitted changes
- Continue with the commit workflow below
Commit workflow
Stage and commit ALL the changes in the git repo (not just the ones in this session). Use gh cli to check if a PR exists for this branch. If no PR exists, create one with an appropriate title and description. If a PR exists, query its current title and description and update them if the new changes warrant it. Push the changes.
Ignore developer tooling changes (e.g. changes to .gitignore, or agent skills, or anything in dev-tools or .bin) in the commit message or PR title/description, unless the PR is solely about those changes.
Release note labels
When creating or updating a PR in this repo, make sure it has a changelog label so GitHub Releases can categorize it correctly.
Prefer one of:
enhancementbugdocumentation
If the correct label is unclear, prefer enhancement.
If the PR should be excluded from release notes, use skip-changelog.
Use skip-changelog for PRs focused only on developer tooling changes, such as agent skills, workflow plumbing, local tooling, or similar maintenance that should not appear in user-facing release notes.
PR body formatting
When the PR body contains Markdown code spans/backticks, parentheses, angle brackets, or shell-sensitive characters, do not pass it directly via --body "..." because shells can mangle it.
Use --body-file with stdin/heredoc instead:
cat <<'EOF' | gh pr create --base main --head <branch> --title "<title>" --body-file -
## Summary
- item with `code`
EOF
Use the same pattern for updates:
cat <<'EOF' | gh pr edit <branch-or-number> --body-file -
## Updated Summary
- item with `code`
EOF
CI and review gating
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 92 lines · 32 tokens per session scan A 49b196fbdadc
push-everything is a skill published in the GitHub repository saffron-health/libretto (887 stars, last pushed 17d ago), licensed MIT. It adds 32 tokens to every session and 1,018 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
atmos-git
Atmos Git and GitOps: git.repositories, clone/pull/status/diff/commit/push/clean, local Git hook shims, signed commits, managed workdirs, fork-PR trust gate, and auth via identities or github/sts.
implementing-secret-scanning-with-gitleaks
This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for…
security-pipeline
Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.
phx-pr-review
Address feedback left on a GitHub pull request: fetch unresolved review threads, make agreed Elixir/Phoenix code fixes, reply, and resolve. Use for a PR URL/number or reviewer comments. NOT for pre-PR review, findings triage, or CI monitoring.
commit-pr
Mandatory Codex/Copilot publication adapter for opencode-swarm. Use for every GitHub issue assignment that results in code changes, commits, pushes, draft PRs, PR body edits, PR readying, release notes, or CI closeout. Must be loaded before git push, gh pr create, gh pr edit, or gh pr ready. Routes to the single…
caveman-commit
Ultra-compressed commit message generator. Cuts noise from commit messages while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious. Use when user says "write a commit", "commit message", "generate commit", "/commit", or invokes /caveman-commit.…