Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ssheleg/sheleg-dev/error-trackingnpx skills add ssheleg/sheleg-dev --skill error-trackinggit clone --depth 1 https://github.com/ssheleg/sheleg-devWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00233 | $0.02922 |
| Opus 5 | $0.00117 | $0.01461 |
| Sonnet 5 | $0.00047 | $0.00584 |
| Haiku 4.5 | $0.00023 | $0.00292 |
Grade A, and why
error-tracking scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
behind a shared MCP gateway.** Run the curl before choosing a channel; a static How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
error-tracking — Sentry wired so it does not leak, and so a stack trace names a commit
Adding Sentry is four lines of SDK setup, which is why it is usually done badly. The four failures below were all observed, on this machine, in one session, by an agent working without this skill.
| Observed failure | What it cost |
|---|---|
| Called "get a DSN" a manual human step needing an account | The account existed and the CLI was already authenticated. Error tracking sat switched off for no reason |
Wrote a before_send scrubber without knowing EventScrubber exists and runs by default |
Could not say which layer covered what, so could not say whether the code was redundant or load-bearing |
| Did not know the MCP is OAuth | Would have declared it in the machine's shared gateway, where an OAuth flow cannot complete |
| Would have set a DSN and stopped | Every issue lands on a release with no commits; suspect-commit attribution never works |
The one that actually leaks
Sentry's built-in scrubber matches KEY NAMES. It does not look inside string values. A credential embedded in a URL — inside a message, an exception value, a breadcrumb — passes through untouched.
Measured against sentry-sdk 2.19.2 on 2026-08-24:
from sentry_sdk.scrubber import EventScrubber
event = {"message": "could not connect to postgresql://u:SUPERSECRET@host/db"}
EventScrubber().scrub_event(event)
assert "SUPERSECRET" in str(event) # passes — it was NOT scrubbed
EventScrubber is on by default, its denylist holds 32 keys (password,
token, api_key, auth, secret, authorization, …), and dsn and
database_url are not among them.
So a service that already writes a database URL to its log — a common enough mistake — starts forwarding that same password to a third party the moment Sentry is added, with a wider blast radius than the log had.
Two layers, always:
from sentry_sdk.scrubber import DEFAULT_DENYLIST, EventScrubber
sentry_sdk.init(
dsn=..., environment=..., release=...,
event_scrubber=EventScrubber( # layer 1 — keys
denylist=DEFAULT_DENYLIST + ["dsn", "database_url", "auth_key"],
recursive=True,
),
before_send=scrub_values, # layer 2 — values
send_default_pii=False,
)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 260 lines · 233 tokens per session scan A 1230981f2618
error-tracking is a skill published in the GitHub repository ssheleg/sheleg-dev (2 stars, last pushed 2d ago), licensed MIT. It adds 233 tokens to every session and 2,922 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
clone-website
Reverse-engineer and clone a website in one shot — extracts assets, CSS, and content section-by-section and proactively dispatches parallel builder agents in worktrees as it goes. Use this whenever the user wants to clone, replicate, rebuild, reverse-engineer, or copy any website. Also triggers on phrases like "make a…
prettify
Iteratively improves the visual design of an existing page — making it more sophisticated, richer, and prettier — without redesigning from scratch. Works on any page or UI surface: landing pages, marketing pages, pricing, docs, dashboards, admin views, settings, modals, empty states, etc. Use when the user says…
rebase-themes
Rebase all theme- branches onto main, resolving conflicts while preserving each theme's visual identity. Force-pushes directly to theme branches with backup tags. Run as a scheduled task or one-off.
propagate-template
Propagate the template's current main into forked AI-store repos (yns-store- in the tenants org), updating every file the store never customized and reporting the rest. Content-level reconcile — store repos share NO git history with the template. Use for "template rebase", "propagate template", "sync store repos"…
frontend-design
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications. Generates creative, polished code that avoids generic AI aesthetics.
audit
Perform comprehensive audit of interface quality across accessibility, performance, theming, and responsive design. Generates detailed report of issues with severity ratings and recommendations.