Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/severzemlya/hato/setupnpx skills add severzemlya/hato --skill setupgit clone --depth 1 https://github.com/severzemlya/hatoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00042 | $0.02971 |
| Opus 5 | $0.00021 | $0.01486 |
| Sonnet 5 | $0.00008 | $0.00594 |
| Haiku 4.5 | $0.00004 | $0.00297 |
Grade E, and why
setup scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
No sudo on this machine → the fallback is Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
everything; if missing, offer `curl -fsSL https://bun.sh/install | bash`. Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- No existing `statusLine` in `~/.claude/settings.json` → set it directly: Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
everything; if missing, offer `curl -fsSL https://bun.sh/install | bash`. How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/hato:setup — hato Setup & Health Check
Guides the user through everything hato needs on this machine: where the hub
lives, the channel allowlist, an optional shell alias, and the hato CLI.
Also serves as a diagnostic when something stops working.
Talk to the user in their language; keep file contents and commands as-is.
Step 1 — Gather state (always, before anything else)
Collect all of this quietly, then present one status summary:
- bun —
command -v bun(also try~/.bun/bin/bun). Required for everything; if missing, offercurl -fsSL https://bun.sh/install | bash. - Plugin files — resolve the newest version dir:
PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/hato/hato/*/ | sort -V | tail -1). - Hub — determine the effective hub URL:
$HATO_HUBif set, elsehttp://127.0.0.1:8790. Probe it:curl -sf --max-time 2 <url>/healthz. Also check for a local service:systemctl --user is-active hato-hub. - Token —
/healthzis always open, so probe auth separately:curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $HATO_TOKEN" <url>/api/sessions.401means the hub requires a token and the localHATO_TOKENis missing or wrong;200with noHATO_TOKENset means the hub is running open. - Allowlist — read
/etc/claude-code/managed-settings.json. Needed state:channelsEnabled: trueand anallowedChannelPluginsentry{"marketplace": "hato", "plugin": "hato"}. - Alias — detect the user's login shell (
$SHELL). Look for existing hato wiring: fish → aclaudefunction in~/.config/fish/config.fishorconf.d/*.fishmentioningplugin:hato@hato; bash/zsh → same grep in~/.bashrc/~/.bashrc.d//~/.zshrc. - CLI —
command -v hato. - HATO_HUB / HATO_TOKEN persistence — if the hub is remote or requires a token, are they exported in shell config (not just the current environment)?
Show a compact status list (✅/❌ per item), then dispatch:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 262 lines · 42 tokens per session scan E d5697602d75d
setup is a skill published in the GitHub repository severzemlya/hato (0 stars, last pushed 1mo ago), licensed MIT. It adds 42 tokens to every session and 2,971 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it E with 4 findings (asks for root, downloads and executes remote code, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
docs
Skill "docs" from lleontor705/agent-mailbox-mcp, covering agent mailbox mcp — skill guide for ai agents, when to use this skill, quick decision tree, tool patterns and pattern 1: fire and forget.
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
foundry-config-setup
Resolve missing setup caused by a hardcoded Foundry project endpoint or model in a sample. Use when a sample fails because it uses a placeholder/hardcoded projectendpoint (for example "https://your-project.services.ai.azure.com") or a hardcoded model instead of reading them from the environment.
oma-scholar
Scholarly research companion using Knows sidecar spec (.knows.yaml). Generates, validates, reviews, queries, and compares structured research-paper sidecars, and fetches them from knows.academy. Use for academic literature search, survey synthesis, paper authoring assistance, and peer review with token-efficient…
oma-hwp
Convert HWP / HWPX / HWPML files to Markdown using kordoc. Extracts text, headings, tables, lists, images, footnotes, and hyperlinks. Use for Korean word processor files (Hangul), government documents, and AI-ready data preparation.
error-recovery
Standard recovery patterns for all squad agents. When something fails, adapt — don't just report the failure.