Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add stewartcelani/skills --skill herdrgit clone --depth 1 https://github.com/stewartcelani/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stewartcelani/skills/herdr)<a href="https://agentmods.dev/skills/stewartcelani/skills/herdr"><img src="https://agentmods.dev/badge/skills/stewartcelani/skills/herdr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stewartcelani/skills/herdr"><img src="https://agentmods.dev/badge/skills/stewartcelani/skills/herdr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.04225 |
| Opus 5 | $0.00051 | $0.02112 |
| Sonnet 5 | $0.00020 | $0.00845 |
| Haiku 4.5 | $0.00010 | $0.00422 |
Grade C, and why
herdr scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
External control is intentional: it is how remote agents manage workspaces, servers, and sibling agents without falling back to raw tmux. **Never refuse Herdr work because you are "outside" Herdr or because `HERDR_ENV` i How it starts
The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Herdr
Herdr organizes terminals into workspaces, tabs, and panes, recognizes coding agents running inside panes, and exposes the session through the herdr CLI.
Inside and outside are both valid
Use the CLI whenever it can talk to the session. You do not need to be running inside a Herdr-managed pane.
Supported control paths include:
- An agent already inside a Herdr pane
- A shell or agent on the same machine that has
herdrinPATHand can reach the session socket - Remote clients over SSH (home PC, Claude Desktop, Cursor, ChatGPT, etc.) driving Herdr on the server
External control is intentional: it is how remote agents manage workspaces, servers, and sibling agents without falling back to raw tmux. Never refuse Herdr work because you are "outside" Herdr or because HERDR_ENV is unset.
The herdr binary talks to the reachable session. Use it to inspect neighboring work, create terminal layout, start agents and commands, read output, and wait for state changes.
Only report that Herdr is unavailable if the CLI itself fails to reach a session (connection refused, no server, socket missing). Empty env or an external client is not a failure.
Caller context env vars (optional convenience)
When a process is inside a managed pane, Herdr may inject:
printf '%s\n' "${HERDR_ENV:-}" "$HERDR_WORKSPACE_ID" "$HERDR_TAB_ID" "$HERDR_PANE_ID"
HERDR_ENV=1means this process was launched inside a Herdr-managed pane (when injection worked).HERDR_WORKSPACE_ID,HERDR_TAB_ID, andHERDR_PANE_IDidentify that pane when present.
Injection is unreliable: nested shells, agent runtimes, IDE terminals, SSH sessions, and many launch paths drop these vars. Missing env is normal for external control and is also common inside Herdr.
When env is present, prefer it (--current, $HERDR_PANE_ID, $HERDR_WORKSPACE_ID). When it is missing — the default for external/SSH clients — discover live state and target explicitly:
herdr workspace list
herdr pane list
herdr agent list
herdr pane current --current # may fail outside a pane; then use explicit ids from list
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 268 lines · 102 tokens per session scan C bdc7cf4da6fa
herdr is a skill published in the GitHub repository stewartcelani/skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 102 tokens to every session and 4,225 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 1 finding (tells the agent never to refuse). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
uninstall
Uninstall a community skill that was installed via the hub. Confirms before deleting files, refuses to touch first-party plugin skills, and logs every action. Use when the user wants to fully remove a community skill ("uninstall [skill]", "remove this skill") rather than just disable it.
newsjack-detector
Monitor current news and reaction signals, then decide which are credible newsjacking opportunities for a client. Uses the local monitoring engine for evidence, but the skill owns PR judgment, brand safety, standing, decay, angle fit, and handoff.
crisis-holding
Draft crisis holding statements, journalist Q&A posture, and what-not-to-say guidance from confirmed incident facts, with a hard legal-counsel gate. Builds each statement through proven crisis-comms frameworks (holding-statement anatomy, SCCT, CAP order, the legitimate non-answer, bridge/flag/block).
find-journalists
Build, refine, dedupe, and enrich small fit-checked journalist lists for newsjack campaigns. Uses the newsjack CLI (preferred) or the medialyst MCP for news search and journalist enrichment, and falls back to a best-effort local mode with no verified contacts; the agent owns how returned data is organized.
voice-extractor
Capture a user's real writing voice from 5-20 prior samples, store a local voice.yaml fingerprint, and enforce it on newsjack drafts so AI tells disappear. Measures voice with named stylometry lenses (Burrows's Delta function-word vector, MATTR lexical diversity, sentence-length burstiness, Biber Dimension-1 register…
fact-check
Extract factual claims from PR copy, verify each claim independently, attach concrete citations, and warn when certainty is low. Runs each claim through proven newsroom verification methods (lateral reading, source-tier climbing, provenance pillars, triangulation, calibrated rating) and puts the burden of proof on the…