Borrowing it
Nothing to install: this file belongs to SiriusNEO/StarAgent. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SiriusNEO/StarAgent/main/.agents/staragent-use/SKILL.mdgit clone --depth 1 https://github.com/SiriusNEO/StarAgentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/siriusneo/staragent/staragent-use)<a href="https://agentmods.dev/skills/siriusneo/staragent/staragent-use"><img src="https://agentmods.dev/badge/skills/siriusneo/staragent/staragent-use.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 51 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 52 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 125 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 126 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 170 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 171 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 172 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01428 |
| Opus 5 | $0.00000 | $0.00714 |
| Sonnet 5 | $0.00000 | $0.00286 |
| Haiku 4.5 | $0.00000 | $0.00143 |
Grade B, and why
staragent-use scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo tailscale up --ssh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl --noproxy '*' http://<node-host-or-100.x-ip>:8081/api/health How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
StarAgent Use
StarAgent is a tmux-first dashboard for long-lived coding CLI sessions. Live tmux sessions are the source of truth. The web dashboard, Chat, Terminal, and file views are projections over real tmux state.
Concepts
- Hub: the web dashboard and coordinator. It also acts as the local node.
- Node: a machine that owns tmux sessions and exposes them through the StarAgent node API.
- Agent session: a tmux session running Codex, Claude Code, Gemini, OpenCode, or shell.
- System session: infrastructure tmux session such as
staragent-hub,staragent-node, orstaragent-tailscaled. - Terminal: live tmux PTY view and ground-truth display.
- Chat: mobile-friendly structured view derived from the tmux transcript.
Reserve agent for coding CLIs. Use node for infrastructure hosts.
Runtime State
Project-local state should live in .staragent/ by default.
Important environment variables:
STARAGENT_AUTH_TOKEN: dashboard auth token for the Hub.STARAGENT_NODE_TOKEN: shared token used by remote nodes.STARAGENT_STATE_DIR: optional runtime state directory override.
Start StarAgent
Install:
pip install -e '.[dev]'
Start the Hub:
staragent hub --host 0.0.0.0 --port 8080
staragent hub creates the staragent-hub tmux system session by default.
Start a remote Node:
export STARAGENT_NODE_TOKEN="<same token as the Hub>"
sudo tailscale up --ssh
staragent node-ts --sudo
staragent node-ts checks for Tailscale and confirms it is connected, then starts the
staragent-node tmux system session and configures tailscale serve. If Tailscale
is missing or not connected, it must print the tailscale up --ssh command to run first
and stop before creating the Node tmux session.
Use staragent node instead when LAN or another network layer already exposes the Node.
Add the node endpoint from the dashboard Nodes page after it is reachable from the Hub.
Sessions
Create a local session:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 188 lines · 0 tokens per session scan B 394bf19c912b
staragent-use is a skill published in the GitHub repository SiriusNEO/StarAgent (59 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,428 tokens. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
html-artifacts
Author the HTML for a plan artifact, dashboard iframe, or Slack attachment — structure, design plan, available runtime, theming, and craft. Read this before writing HTML for saveplan, outputiframe, or slackattachhtml.
langbot-eba-adapter-dev
Build, refactor, and test LangBot platform adapters for the Event-Based Agents architecture. Use when adding or migrating Telegram, Discord, or other messaging platform adapters to the EBA adapter layout, validating unified event/message conversion, writing live adapter probes, or using standalone plugin runtime plus…
langbot-plugin-dev
Develop, debug, and test LangBot plugins. Use when creating new LangBot plugins, fixing plugin bugs, setting up a LangBot test environment, or testing plugins via WebSocket. Covers plugin component architecture (EventListener, Command, Tool), the plugin SDK API (invokellm, getllmmodels, sendmessage, plugin storage)…
bootstrap-repo-analysis
First-time analysis of a repository with no prior reviewer outcomes. Crawl historical merged-PR review feedback with the gh CLI (plus any preloaded samples), extract the team's review norms, and synthesize the initial per-repo review-style prompt. Use this for a cold-start repo; use continual-learning instead once the…
langbot-mcp-ops
Operate a LangBot instance through its built-in MCP (Model Context Protocol) server. Use when an AI agent needs to manage LangBot — list/create/update/delete bots, pipelines, models, knowledge bases, MCP servers, and skills — over MCP instead of raw HTTP. Covers the /mcp endpoint, API-key auth (web-UI lbk keys and the…
langbot-dev
Develop, build, and debug the LangBot core backend and web frontend. Use when working inside the LangBot repository — backend (Python/Quart, src/langbot/pkg), the Vite/React web UI, HTTP API controllers/services, Alembic migrations, or the MCP server. Covers the dev environment (uv, pnpm), repo layout, the API auth…