Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sergeyklay/.agents --skill isolate-cligit clone --depth 1 https://github.com/sergeyklay/.agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sergeyklay/.agents/isolate-cli)<a href="https://agentmods.dev/skills/sergeyklay/.agents/isolate-cli"><img src="https://agentmods.dev/badge/skills/sergeyklay/.agents/isolate-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sergeyklay/.agents/isolate-cli"><img src="https://agentmods.dev/badge/skills/sergeyklay/.agents/isolate-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 70 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00208 | $0.03747 |
| Opus 5 | $0.00104 | $0.01873 |
| Sonnet 5 | $0.00042 | $0.00749 |
| Haiku 4.5 | $0.00021 | $0.00375 |
Grade A, and why
isolate-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Confine an External CLI
A CLI invoked as a subprocess is not a function call. It reads the operator's global configuration, writes per-run state under the home directory keyed to the directory it ran in, and treats a config file it cannot compile as advice rather than as an instruction. None of those three shows up in an exit code: the private content piped in lands in a plaintext log outside the repository, the host accumulates state nobody audits, and the confinement believed to be in force is absent.
This skill is the mechanics of running such a tool and being able to say afterwards what it read, what it wrote, and what it left behind. Whether the run's result is evidence is a separate question and belongs to prove-checks.
Trigger
- A script or skill invokes a third-party CLI as a subprocess: an agent CLI, a linter with a cache, a package manager, a formatter, anything with a state store outside the working directory.
- A second tool or provider branch is added to a script that already does this.
- The tool is handed a policy, deny-list, allow-list or sandbox configuration.
- The content piped in is private: an unmerged diff, a prompt, a credential, customer data.
- A measurement or benchmark series will invoke the tool repeatedly and the runs have to be comparable to each other.
Not this skill: reading the tool's behavior to answer a general question, which is research-it, or deciding whether the green that came out counts as proof, which is prove-checks.
Procedure
1. Read the state roots out of the installed artifact
The copy on disk is the one that runs. Release notes, the project README and the upstream default branch each describe a different one, and two versions of the same CLI commonly sit side by side under different runtime or package managers. Resolve and record the version and the real path before reading anything: command -v tool, then readlink -f on the result, then the package manifest or lockfile that installed it. This is research-it's source-priority rule narrowed to a single copy on disk (OPTIONAL when the question widens past this run into how the tool behaves in general).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed a81e8f67ba67
- 3d ago Changed · +4 lines 925b94e9ea10
- 5d ago First seen · 128 lines · 208 tokens per session scan A ca7e597f7a7b
isolate-cli is a skill published in the GitHub repository sergeyklay/.agents (5 stars, last pushed today), licensed Apache-2.0. It adds 208 tokens to every session and 3,747 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
chatdoc-studio-api
ChatDOC Studio API usage guide - complete documentation and examples for PDF parsing, chat applications, agent applications, content retrieval, and data extraction APIs.
war-room
Multi-agent research war room. Personas debate in sequential turns through two phases — ideation and proposal writing. Persona persistence and drift detection are enforced every turn via the persistent-persona skill.
system-info
Probe system resources — CPU, RAM, disk, GPU/CUDA/MPS — and translate findings into experiment design recommendations. Run this at the start of any compute-intensive project.
persistent-persona
Mechanism for keeping an agent anchored to a caller-defined persona across sessions. Covers the biplate private memory system for drift detection and self-correction.
memory-checkpoint
Defines how to save and load agent state as checkpoint files.
ChatDOC Studio--KnowledgeMate
Create and operate ChatDOC Studio knowledge bases through pdrouter using a Bearer API key and JavaScript helpers. Use when Codex needs to upload one or more PDF/DOC/DOCX files, skip failed files without aborting the whole job, create a knowledge base from successful uploads, or call the ChatDOC Studio knowledge-base…