Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add subinium/vibesubin --skill setup-cigit clone --depth 1 https://github.com/subinium/vibesubinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/subinium/vibesubin/setup-ci)<a href="https://agentmods.dev/skills/subinium/vibesubin/setup-ci"><img src="https://agentmods.dev/badge/skills/subinium/vibesubin/setup-ci.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.06522 |
| Opus 5 | $0.00043 | $0.03261 |
| Sonnet 5 | $0.00017 | $0.01304 |
| Haiku 4.5 | $0.00009 | $0.00652 |
Grade B, and why
setup-ci scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
**Common failure:** sudo prompts for a password and the CI job hangs. Always verify NOPASSWD is set up or use a user that doesn't need sudo. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
│ ├── Post-deploy health check # curl -f /health, fail loudly How it starts
The opening of the file, as written. The whole thing — 401 lines — stays where its author put it; the contents beside it link to each section on GitHub.
setup-ci
CI/CD is one of the hardest topics for non-developers because it sits at the intersection of git, servers, authentication, and secrets management. Most tutorials jump straight to YAML. This skill starts earlier.
Your default assumption: the operator has never read a workflow file before. Don't patronize them, but don't skip concepts either.
State assumptions — before acting
Before starting the procedure, write an explicit Assumptions block. Don't pick silently between interpretations; surface the choice. If any assumption is wrong or ambiguous, pause and ask — do not proceed on a guess.
Required block:
Assumptions:
- Stack: <detected from package.json/Cargo.toml/go.mod/requirements.txt — single stack or monorepo>
- Deploy target: <none | SSH | Vercel | Fly.io | Cloud Run | Netlify | GitHub Pages>
- Existing CI: <none | partial (.github/workflows/*.yml with N workflows) | full>
- Secrets state: <to be configured by operator in GitHub UI — this skill never handles credentials>
Typical items for this skill:
- The detected stack (from package.json / requirements.txt / Cargo.toml / go.mod)
- The deploy target (SSH / Vercel / Fly.io / Cloud Run / Netlify / GitHub Pages / none)
- Whether Secrets are already configured in the GitHub UI — the skill never creates them, only lists what's needed
Stop-and-ask triggers:
- Multiple stacks coexist (e.g., Next.js frontend + Python backend) without clear monorepo structure — ask which one this workflow is for
- No deploy target detectable from config — ask explicitly, never guess
Silent picks are the most common failure mode: the skill runs, produces plausible output, and the operator doesn't notice the wrong interpretation was chosen. The Assumptions block is cheap insurance.
Step 1 — Figure out what the operator actually wants
Before generating any YAML, ask the operator two questions, one at a time. Don't ask all at once.
Question 1: "What happens when you push code today? Do you deploy manually, or is something already automated?"
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 401 lines · 85 tokens per session scan B 65c0d3a6d68b
setup-ci is a skill published in the GitHub repository subinium/vibesubin (50 stars, last pushed 4mo ago), licensed MIT. It adds 85 tokens to every session and 6,522 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
neo-azure-pipelines
Use this skill when the user asks to create, review, debug, or modernize Azure Pipelines YAML for CI/CD, especially .NET builds, Azure App Service deploys, or IIS/on-premises deploys. Prefer bundled templates and verify task syntax against Microsoft docs when version-specific accuracy matters.
gh-fix-ci
Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use gh to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL.
dev-branch-deploy
Drive the Hermes/Maia Concourse dev-branch deploy workflow — test stack changes in a live lab before merging to master. Use for "dev branch", "deploy to dev", "hermes-dev-branch", "maia-dev-branch", "test in labs", "dev lane". Covers both the hermes and maia stacks.
ci-cd-patterns
CI/CD: GitHub Actions, GitLab CI, Jenkins, caching, blue-green, canary. Triggers: CI, CD, pipeline, GitHub Actions, workflow YAML, release, canary, rollout.
squid-implement-night
Run the full agent-team pipeline end-to-end for one feature whose Tasks Plan is already approved by /squid-plan, handing the human a validated, ready-to-squash-merge PR. Trigger after /squid-plan.
ci
Detect/generate/debug CI pipeline config (GitHub Actions, GitLab CI). Triggers: CI setup, build pipeline, GitHub Actions config, debug CI, GitLab CI.