Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sky-valley/pi --skill pi-syncgit clone --depth 1 https://github.com/sky-valley/piWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sky-valley/pi/pi-sync)<a href="https://agentmods.dev/skills/sky-valley/pi/pi-sync"><img src="https://agentmods.dev/badge/skills/sky-valley/pi/pi-sync/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sky-valley/pi/pi-sync"><img src="https://agentmods.dev/badge/skills/sky-valley/pi/pi-sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03338 |
| Opus 5.5 | $0.00026 | $0.01335 |
| Sonnet 5.5 | $0.00013 | $0.00668 |
| Haiku 4.5 | $0.00007 | $0.00334 |
Grade A, and why
pi-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pi-sync — the daily porting job
Orchestrates one sync cycle. State lives in docs/UPSTREAM.md (the pin + the
ledger); this skill is restartable — a half-finished ledger resumes where it
stopped.
0. Preflight
- Repo: clean working tree on
main,git pullfirst. Full gate must be green BEFORE starting (go build ./... && go vet ./... && go test ./...); never start a sync on a broken base. - Upstream clone at
$PI_UPSTREAM_DIR(default~/.cache/pi-upstream); clone if missing,git fetch origin main, then fast-forward its working tree:git -C "$dir" checkout -B main origin/main. The clone is a read-only mirror — nothing is ever committed to it, and the differential harness extracts from it withgit archive <sha>— so this is always safe. Without it the checkout drifts arbitrarily far behind: at the 2026-08-11 sync it was still on a 2026-06-07 commit, ~2 months stale, and a plaingrepof it reported the OPPOSITE of what the pin contained, reading as though upstream had reverted the change being ported. - Standing rule, independent of the above: never read the clone's working
tree. Every upstream read names a sha —
git show <sha>:<path>,git diff <sha>^1..<sha>,git grep <pattern> <sha> -- <path>. A fast-forwarded tree is atorigin/main, which mid-cycle is AHEAD of the pin, so it is not the thing under triage or review either. Pass this rule to every triage/review subagent you spawn; the 2026-08-11 cycle is on record because a reviewer nearly filed a phantom finding from it. - Read the pin from
docs/UPSTREAM.md. Delta = the union rangepin..origin/main(git log, not--first-parent); report the first-parent count beside it. Merged side branches carry real mainline commits: on 2026-09-23 the first-parent line ran along upstream'sdurablebranch, and both the pin and two ported commits were reachable only through merge second parents. Judge a merge by diffing it against EACH parent. If empty: record the check date in UPSTREAM.md and stop. - If the delta contains a release tag: refresh the npm reference build
(
npm i @earendil-works/pi-ai@<ver> @earendil-works/pi-coding-agent@<ver>in the scratch dir) so parity review compares against what now ships. - Re-capture
coding/testdata/defaultmodelsat EVERY re-pin (npm build at a release,capture.mjs --src <sha>between releases): it pins the wholedefaultModelPerProvidertable, which has caused a miss twice.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +9 lines eb68e95742db
- 27d ago Changed · +23 lines 817ac727b730
- 1mo ago Changed · +1 lines 16ea0f061cf3
- 1mo ago Changed · +6 lines e1092a000fc8
- 1mo ago Changed · +35 lines 685684c08e1e
- 1mo ago First seen · 132 lines · 66 tokens per session scan A ff5f249dc1b3
pi-sync is a skill published in the GitHub repository sky-valley/pi (78 stars, last pushed 18d ago), licensed MIT. It adds 66 tokens to every session and 3,338 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
update-v8-version
Update Codex's pinned v8 / rustyv8 versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update rustyv8 artifacts, prepare or validate a V8 release candidate, check v8-canary, or diagnose why a V8 version update no longer builds.
release
Release gentle-pi through GitHub and npm. Trigger: release, publish, npm publish, GitHub release, version bump.
check-linters-before-commit
Before any commit, run linters, vet, tests, and build verification; do not commit until checks pass.
release
Create a new versioned release with changelog. Bumps version in code, updates CHANGELOG.md, commits, tags, and pushes using the repository release flow. GitHub Actions creates the release and uses only the current changelog section as release notes. Use when the user says "release", "cut a release", "bump version"…
crawlkit
Maintain and release the crawlkit Go library, preserving downstream compatibility for gitcrawl, slacrawl, discrawl, and notcrawl.
pypi-release
This skill should be used when releasing tunacode-cli to PyPI. It keeps the existing local release checks, then hands the actual PyPI upload to a GitHub Actions workflow that uses the repository's PYPIAPITOKEN secret.