Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sungurerdim/dev-skills --skill ds-devopsgit clone --depth 1 https://github.com/sungurerdim/dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sungurerdim/dev-skills/ds-devops)<a href="https://agentmods.dev/skills/sungurerdim/dev-skills/ds-devops"><img src="https://agentmods.dev/badge/skills/sungurerdim/dev-skills/ds-devops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sungurerdim/dev-skills/ds-devops"><img src="https://agentmods.dev/badge/skills/sungurerdim/dev-skills/ds-devops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.04265 |
| Opus 5.5 | $0.00014 | $0.01706 |
| Sonnet 5.5 | $0.00007 | $0.00853 |
| Haiku 4.5 | $0.00004 | $0.00426 |
Grade A, and why
ds-devops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ds-devops
Broken CI pipelines, unsigned builds, and outdated dependencies silently erode release quality. This skill audits your entire DevOps setup and flags what needs fixing.
DevOps Audit — CI/CD pipelines, code signing, dependency management, and deployment configuration for any project type.
Completion Evidence — applies to every phase: Report
done/OKonly with the machine-checkable evidence the gates name — the exact command run and its observed output (orfile:linediff). Missing evidence → reportINCOMPLETEplus what is missing. Self-assessment is never evidence. (This band repeats at file end by design — both copies are normative.)
Triggers
- User runs
/ds-devops - User asks to audit or review CI/CD, pipelines, deployment, or DevOps setup
- User asks about dependency management, code signing, or CI quality gates
- User asks why CI is failing or how to set up CI for a project
Triggers — INVOKE / DON'T INVOKE
| INVOKE | DON'T INVOKE |
|---|---|
| "audit CI/CD pipeline", "review GitHub Actions workflows" | "deploy the app to infra" (→ ds-deploy) |
| "set up code signing for releases" | "configure VPS / containers / SSL" (→ ds-deploy) |
| "audit release pipeline + version bump workflow" | "audit repo settings / branch protection" (→ ds-repo) |
| "dependency audit gate in CI" | "monitoring, alerting, SLOs" (→ ds-deploy) |
Contract
Dimensions: D6, C1 (CI/CD security) Framework alignment (advisory): DORA (D6), OWASP ASVS (C1).
- Every finding cites file and line — never infer or assume.
- Only audits CI/CD, signing, dependencies, release pipelines.
- Standalone. Uses blueprint profile or
ds/audit/findings.mdwhen available; own analysis when absent. - Full accounting enforced: every finding and planned check ends in an explicit disposition (fixed / skipped + reason / only you can do); summary totals balance.
- Pre-existing / out-of-scope errors detected during work are NOT skipped — fixed inline or escalated with concrete blocker.
- State-exempt: audit is regenerable; generated configs/fixes land in the working tree — git is the durable record.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +2 lines fb0427d15824
- 1mo ago First seen · 224 lines · 36 tokens per session scan A 48ff352571a6
ds-devops is a skill published in the GitHub repository sungurerdim/dev-skills (1 stars, last pushed 1mo ago), licensed MIT. It adds 36 tokens to every session and 4,265 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
devops
You are the DevOps Specialist -- the single authority on version control, CI/CD pipelines, platform operations (GitHub, Azure DevOps, GitLab), infrastructure, deployment, backup, and cleanup. If it touches git, pipelines, or production infrastructure, it's yours.
release
Use this agent for versioning, changelogs, release notes, deployment coordination, and release process management.
git-ci
CI/CD status queries for GitHub Actions (gh) and GitLab CI (glab). Check pipeline status, failing jobs, workflow runs, job logs, and merge readiness. Use when checking CI status, debugging build failures, viewing job logs, watching pipeline progress, or configuring gh/glab CI read-only allowlists. Not for PR workflows…
production-orchestrator
Use this agent for end-to-end PRD-to-production pipeline execution with zero-tolerance validation, compliance gates, and rollback capability.
cron-expression-translator
Translates cron expressions to plain English and back. Use when a cron schedule in code/config is unclear, or when you know when something should run but not the cron syntax for it.
ci-cd-pipeline-optimizer
Audits CI/CD workflows (GitHub Actions, GitLab CI) to implement caching, parallelization, and cut build durations.