Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sebastienrousseau/dotfiles --skill dotfiles-bootstrapgit clone --depth 1 https://github.com/sebastienrousseau/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sebastienrousseau/dotfiles/dotfiles-bootstrap)<a href="https://agentmods.dev/skills/sebastienrousseau/dotfiles/dotfiles-bootstrap"><img src="https://agentmods.dev/badge/skills/sebastienrousseau/dotfiles/dotfiles-bootstrap.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.01040 |
| Opus 5 | $0.00044 | $0.00520 |
| Sonnet 5 | $0.00018 | $0.00208 |
| Haiku 4.5 | $0.00009 | $0.00104 |
Grade A, and why
dotfiles-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dotfiles-bootstrap
Provision a new workstation from a public dotfiles repository through
the sebastienrousseau/dotfiles harness.
This skill is for Claude Code to invoke dot init <user> on the user's behalf — most useful when the user says "set me up like Alice" or "bootstrap a fresh laptop using my GitHub dotfiles."
What this skill does
When invoked, it:
- Verifies the target argument is one of:
- a GitHub username (e.g.
alice→ expands togithub.com/alice/dotfiles) - an
owner/repopair (e.g.alice/configs) - a full HTTPS or
git@host:pathclone URL
- a GitHub username (e.g.
- Refuses plain
http://URLs (no transit integrity). - Reads the user's current agent profile from
$DOT_AGENT_PROFILE(defaults toask):ask→ rundot init <user> --dry-run(read-only preview)plan→ rundot init <user> --dry-runand explain the planapply→ rundot init <user>(full apply withchezmoi apply)audit→ rundot init <user> --no-apply(clone only, no chezmoi apply)
- Surfaces the trust prompt warnings before any clone runs — the target repo's scripts execute with the user's privileges.
- Reports the outcome (success / failed / aborted-by-trust-prompt) so the user can decide next steps.
Invocation pattern
# canonical
dot init <user> # github.com/<user>/dotfiles
dot init <owner>/<repo> # github.com/<owner>/<repo>
dot init <https-or-ssh-url> # explicit URL
# safety flags
dot init <user> --dry-run # preview only
dot init <user> --no-apply # clone, skip chezmoi apply
dot init <user> --force # overwrite existing chezmoi source dir
Profile-aware defaults
| Profile | Default flag set | Notes |
|---|---|---|
ask |
--dry-run |
Show the plan; ask the user before running for real. |
plan |
--dry-run |
Same plan, augmented with chezmoi diff if available. |
apply |
(no flags) | Full apply; interactive trust prompt remains. |
audit |
--no-apply |
Clone the source; let the user inspect before apply. |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 85 lines · 88 tokens per session scan A 151ccb9083b3
dotfiles-bootstrap is a skill published in the GitHub repository sebastienrousseau/dotfiles (75 stars, last pushed 3d ago), licensed Apache-2.0. It adds 88 tokens to every session and 1,040 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
avatar-contribution-pr
Turn an avatar GitHub issue (from the in-app avatar-editor easter egg) into a merged sprite — validate the art, then either add a new module or replace an existing one, and open a PR that closes the issue. Handles both "Avatar contribution: " (a brand-new sprite) and "Avatar edit: " (a hand-redraw of an existing…
toolbelt
Inventory of the CLI tools actually installed on this machine (aqua/mise/nix) and which one to reach for per task — search, structural rewrite, structured data, diff, HTTP, profiling, VCS, k8s, security, docs, media. Use when picking a command-line tool, when a POSIX default (grep/find/sed/curl/wc) feels clumsy, when…
oss-launch
Turn one open-source release/topic into platform-tailored posts and publish them through a gated, auditable path. Use when the user wants to announce or promote an OSS project/release across X, Bluesky, dev.to, Reddit, Hacker News, etc. Triggers: "announce my release", "promote my repo", "post about this project"…
remotion
Build, run, and render videos programmatically with Remotion (React-based video). Use when scaffolding a Remotion project, writing compositions/animations, previewing in Remotion Studio, rendering to MP4/WebM/GIF/stills, embedding the Remotion Player, or troubleshooting Remotion + Bun. Triggers - "Remotion"…
frontend-design
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
create-skill
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.