Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/stacklok/toolhive-studio/devcontainer-devnpx skills add stacklok/toolhive-studio --skill devcontainer-devgit clone --depth 1 https://github.com/stacklok/toolhive-studioWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00142 | $0.03647 |
| Opus 5 | $0.00071 | $0.01824 |
| Sonnet 5 | $0.00028 | $0.00729 |
| Haiku 4.5 | $0.00014 | $0.00365 |
Grade B, and why
devcontainer-dev scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo modprobe iptable_nat iptable_filter ip_tables How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Containerized Dev Environment
An isolated, cross-platform test environment for ToolHive Studio. The whole Electron app — including its backend thv binary and the MCP-server containers it spawns — runs inside a single devcontainer. You interact with the UI via a noVNC browser tab.
The entire stack (Node, Electron, display server, window manager, VNC server, Docker-in-Docker, DBus, keyring) lives in the container. Nothing is installed on the host. That's the whole point: every worktree can have its own container and its own experiments, with zero risk of contaminating the user's global installs.
Entry point
pnpm devContainer:dev
runs scripts/devcontainer-dev.sh on the host. The script is "smart":
- If executed on the host: runs
devcontainer upto build/start the container, thendevcontainer execto run the entrypoint inside it. - If executed inside a container (detected via
/.dockerenv): skips the build step and just runs the entrypoint directly. This path is used by GitHub Codespaces.
The three scripts
| Script | Runs on | Purpose |
|---|---|---|
scripts/devcontainer-dev.sh |
host | Picks a host port, kills stale processes, starts readiness poller, opens browser when ready, devcontainer execs the entrypoint. |
scripts/devcontainer-entrypoint.sh |
in container | Cleans stale X/VNC state, starts Xvfb, fluxbox, x11vnc, websockify/noVNC, dbus, gnome-keyring, then runs pnpm start. |
scripts/devcontainer-post-start.sh |
in container | postStartCommand in devcontainer.json. In Codespaces (detected via $CODESPACES) it nohup-launches the entrypoint in the background so the noVNC preview pane opens without user action. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 277 lines · 0 tokens per session scan B 9e710a0f8730
devcontainer-dev is a skill published in the GitHub repository stacklok/toolhive-studio (163 stars, last pushed 3d ago), licensed Apache-2.0. It adds 142 tokens to every session and 3,647 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
quality
Evaluates whether a GitHub issue is spam, empty, needs more information, or is OK to proceed.
investigate-issue
Investigate a GitHub issue by fetching details, analyzing the codebase, researching documentation, and presenting an actionable implementation plan with test guidance. Use when asked to investigate, analyze, triage, or plan work for a GitHub issue. Invoked with /investigate-issue or /investigate-issue (prompts for ID).
harness-test-writer
Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…
bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints…
hunt-ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session…
session-investigator
Investigate fast-agent session and history files to diagnose issues. Use when a session ended unexpectedly, when debugging tool loops, when correlating sub-agent traces with main sessions, or when analyzing conversation flow and timing. Covers session.json metadata, history JSON format, message structure, tool…