Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sky-valley/pi/pi-syncnpx skills add sky-valley/pi --skill pi-syncgit clone --depth 1 https://github.com/sky-valley/piWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sky-valley/pi/pi-sync)<a href="https://agentmods.dev/skills/sky-valley/pi/pi-sync"><img src="https://agentmods.dev/badge/skills/sky-valley/pi/pi-sync.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00066 | $0.02749 |
| Opus 5 | $0.00033 | $0.01375 |
| Sonnet 5 | $0.00013 | $0.00550 |
| Haiku 4.5 | $0.00007 | $0.00275 |
Grade A, and why
pi-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pi-sync — the daily porting job
Orchestrates one sync cycle. State lives in docs/UPSTREAM.md (the pin + the
ledger); this skill is restartable — a half-finished ledger resumes where it
stopped.
0. Preflight
- Repo: clean working tree on
main,git pullfirst. Full gate must be green BEFORE starting (go build ./... && go vet ./... && go test ./...); never start a sync on a broken base. - Upstream clone at
$PI_UPSTREAM_DIR(default~/.cache/pi-upstream); clone if missing,git fetch origin main, then fast-forward its working tree:git -C "$dir" checkout -B main origin/main. The clone is a read-only mirror — nothing is ever committed to it, and the differential harness extracts from it withgit archive <sha>— so this is always safe. Without it the checkout drifts arbitrarily far behind: at the 2026-08-11 sync it was still on a 2026-06-07 commit, ~2 months stale, and a plaingrepof it reported the OPPOSITE of what the pin contained, reading as though upstream had reverted the change being ported. - Standing rule, independent of the above: never read the clone's working
tree. Every upstream read names a sha —
git show <sha>:<path>,git diff <sha>^1..<sha>,git grep <pattern> <sha> -- <path>. A fast-forwarded tree is atorigin/main, which mid-cycle is AHEAD of the pin, so it is not the thing under triage or review either. Pass this rule to every triage/review subagent you spawn; the 2026-08-11 cycle is on record because a reviewer nearly filed a phantom finding from it. - Read the pin from
docs/UPSTREAM.md. Delta = first-parent main-line changespin..origin/main(a merged PR = one unit). If empty: record the check date in UPSTREAM.md and stop. - If the delta contains a release tag: refresh the npm reference build
(
npm i @earendil-works/pi-ai@<ver> @earendil-works/pi-coding-agent@<ver>in the scratch dir) so parity review compares against what now ships.
1. Triage (skill: pi-triage)
Run pi-triage over the whole delta (subagent). Append all rows to the ledger
in docs/UPSTREAM.md with their verdicts. n/a rows are done.
port-but-QUEUED and port-but-CATALOG-ONLY rows are appended to their entry
in the "Scope queue" / catalog queue instead of being ported. decide rows:
STOP and surface to the user — never silently expand or shrink the port's
scope. Note the 2026-08-27 rewrite made scope decidable by three EXCLUSION
TESTS, which should make decide rarer: before escalating, check that E1/E2/E3
in "The scope boundary" does not already answer it — and remember that "in scope
but no Go home yet" is a Scope queue row, not a decide.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +35 lines 685684c08e1e
- 4d ago First seen · 132 lines · 66 tokens per session scan A ff5f249dc1b3
pi-sync is a skill published in the GitHub repository sky-valley/pi (45 stars, last pushed today), licensed MIT. It adds 66 tokens to every session and 2,749 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aider-delegate
Delegate a coding task to Aider (aider) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Aider - phrasings like "have Aider do X", "delegate this to aider", "run it through Aider", or "use Aider to implement/fix/refactor" - or wants…
codex-delegate
Delegate a coding task to the OpenAI Codex CLI as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Codex — phrasings like "have Codex do X", "delegate this to Codex", "run it through Codex", or "use Codex to implement/fix/refactor" …
commandcode-delegate
Delegate a coding task to the Command Code CLI (cmd) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Command Code — phrasings like "have Command Code do X", "delegate this to commandcode", "run it through cmd", or "use Command Code…
delegate-setup
Configure delegation fleet lanes: which implementer CLI handles which kind of work, with optional model and effort (or variant) dials. Discovers installed CLIs, proposes a lane map for user approval, and writes global or project config only after explicit yes. Use when the user asks to set up, configure, or…
opencode-delegate
Delegate a coding task to the OpenCode CLI as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to OpenCode — phrasings like "have OpenCode do X", "delegate this to OpenCode", "run it through OpenCode", or "use OpenCode to…
warp-delegate
Delegate a coding task to the Warp Agent CLI (oz) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Warp - phrasings like "have Warp implement X", "delegate this to the Warp CLI", "run it through Warp", "use oz to…