Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sergeyklay/.agents --skill isolate-cligit clone --depth 1 https://github.com/sergeyklay/.agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sergeyklay/.agents/isolate-cli)<a href="https://agentmods.dev/skills/sergeyklay/.agents/isolate-cli"><img src="https://agentmods.dev/badge/skills/sergeyklay/.agents/isolate-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sergeyklay/.agents/isolate-cli"><img src="https://agentmods.dev/badge/skills/sergeyklay/.agents/isolate-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 70 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00208 | $0.03924 |
| Opus 5.5 | $0.00083 | $0.01570 |
| Sonnet 5.5 | $0.00042 | $0.00785 |
| Haiku 4.5 | $0.00021 | $0.00392 |
Grade A, and why
isolate-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Confine an External CLI
A CLI invoked as a subprocess is not a function call. It reads the operator's global configuration, writes per-run state under the home directory keyed to the directory it ran in, and treats a config file it cannot compile as advice rather than as an instruction. None of those three shows up in an exit code: the private content piped in lands in a plaintext log outside the repository, the host accumulates state nobody audits, and the confinement believed to be in force is absent.
This skill is the mechanics of running such a tool and being able to say afterwards what it read, what it wrote, and what it left behind. Whether the run's result is evidence is a separate question and belongs to prove-checks.
Trigger
- A script or skill invokes a third-party CLI as a subprocess: an agent CLI, a linter with a cache, a package manager, a formatter, anything with a state store outside the working directory.
- A second tool or provider branch is added to a script that already does this.
- The tool is handed a policy, deny-list, allow-list or sandbox configuration.
- The content piped in is private: an unmerged diff, a prompt, a credential, customer data.
- A measurement or benchmark series will invoke the tool repeatedly and the runs have to be comparable to each other.
Not this skill: reading the tool's behavior to answer a general question, which is research-it, or deciding whether the green that came out counts as proof, which is prove-checks.
Procedure
1. Read the state roots out of the installed artifact
The copy on disk is the one that runs. Release notes, the project README and the upstream default branch each describe a different one, and two versions of the same CLI commonly sit side by side under different runtime or package managers. Resolve and record the version and the real path before reading anything: command -v tool, then readlink -f on the result, then the package manifest or lockfile that installed it. This is research-it's source-priority rule narrowed to a single copy on disk (OPTIONAL when the question widens past this run into how the tool behaves in general).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +3 lines d8cea9128c91
- 1mo ago Changed a81e8f67ba67
- 1mo ago Changed · +4 lines 925b94e9ea10
- 1mo ago First seen · 128 lines · 208 tokens per session scan A ca7e597f7a7b
isolate-cli is a skill published in the GitHub repository sergeyklay/.agents (6 stars, last pushed 5d ago), licensed Apache-2.0. It adds 208 tokens to every session and 3,924 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
autodoc-next-prospectus-audit
Audit one local prospectus PDF, DOC, or DOCX through PDRouter and download the annotated document with AutoDoc NEXT2.0.
ChatDOC Studio--KnowledgeMate
Create and operate ChatDOC Studio knowledge bases through pdrouter using a Bearer API key and JavaScript helpers. Use when Codex needs to upload one or more PDF/DOC/DOCX files, skip failed files without aborting the whole job, create a knowledge base from successful uploads, or call the ChatDOC Studio knowledge-base…
PDFlux-PDF2Markdown
Convert unstructured documents into LLM-ready structured data. Supports PDF, Word, PPT, and images; extracts paragraphs, formulas, tables, charts, and other elements in one step; generates up to 8 levels of headings; and outputs Markdown organized in reading order. Useful for field extraction, comparison and…
Calliper-Compare2Markdown
Compare two local documents and convert differences into LLM-ready Markdown in one synchronous call. Supports PDF, Word, PPT, and image documents accepted by Calliper, and returns a structured markdown diff table suitable for change review, clause comparison, downstream extraction, and rule-based validation.
war-room
Multi-agent research war room. Personas debate in sequential turns through two phases — ideation and proposal writing. Persona persistence and drift detection are enforced every turn via the persistent-persona skill.
system-info
Probe system resources — CPU, RAM, disk, GPU/CUDA/MPS — and translate findings into experiment design recommendations. Run this at the start of any compute-intensive project.