Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add swarmclawai/swarmclaw --skill coding-agentgit clone --depth 1 https://github.com/swarmclawai/swarmclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/swarmclawai/swarmclaw/coding-agent)<a href="https://agentmods.dev/skills/swarmclawai/swarmclaw/coding-agent"><img src="https://agentmods.dev/badge/skills/swarmclawai/swarmclaw/coding-agent/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/swarmclawai/swarmclaw/coding-agent"><img src="https://agentmods.dev/badge/skills/swarmclawai/swarmclaw/coding-agent.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Excessive Agency · line 50 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Tool Misuse · line 93 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 94 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 33 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.00943 |
| Opus 5.5 | $0.00040 | $0.00377 |
| Sonnet 5.5 | $0.00020 | $0.00189 |
| Haiku 4.5 | $0.00010 | $0.00094 |
Grade A, and why
coding-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Coding Agent
Delegate coding tasks to external coding agents via shell tools.
Agent Execution Modes
Claude Code (recommended)
Use --print --permission-mode bypassPermissions for non-interactive execution:
cd /path/to/project && claude --permission-mode bypassPermissions --print 'Your task here'
For background execution, use the shell tool's background mode.
Do NOT use PTY mode with Claude Code — --print mode keeps full tool access and avoids interactive confirmation dialogs.
Codex
Codex requires a git repository and PTY mode:
# Quick one-shot (auto-approves changes)
cd /path/to/project && codex exec --full-auto 'Build a dark mode toggle'
# Codex refuses to run outside a git directory. For scratch work:
SCRATCH=$(mktemp -d) && cd $SCRATCH && git init && codex exec "Your prompt"
Pi Coding Agent
# Install: npm install -g @mariozechner/pi-coding-agent
cd /path/to/project && pi 'Your task'
# Non-interactive mode
pi -p 'Summarize src/'
# Different provider/model
pi --provider openai --model gpt-4o-mini -p 'Your task'
OpenCode
cd /path/to/project && opencode run 'Your task'
PR Reviews
Clone to a temp folder or use git worktree — never review PRs in the SwarmClaw project directory:
# Clone to temp for safe review
REVIEW_DIR=$(mktemp -d)
git clone https://github.com/user/repo.git $REVIEW_DIR
cd $REVIEW_DIR && gh pr checkout 130
codex review --base origin/main
# Or use git worktree
git worktree add /tmp/pr-130-review pr-130-branch
cd /tmp/pr-130-review && codex review --base main
Parallel Issue Fixing
Use git worktrees to fix multiple issues in parallel:
# Create worktrees
git worktree add -b fix/issue-78 /tmp/issue-78 main
git worktree add -b fix/issue-99 /tmp/issue-99 main
# Launch agents (use background shell execution)
cd /tmp/issue-78 && codex --yolo 'Fix issue #78: <description>. Commit when done.'
cd /tmp/issue-99 && codex --yolo 'Fix issue #99: <description>. Commit when done.'
# Create PRs after
cd /tmp/issue-78 && git push -u origin fix/issue-78
gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."
# Cleanup
git worktree remove /tmp/issue-78
git worktree remove /tmp/issue-99
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 112 lines · 99 tokens per session scan A 9ebbf9edb987
coding-agent is a skill published in the GitHub repository swarmclawai/swarmclaw (697 stars, last pushed 3mo ago), licensed MIT. It adds 99 tokens to every session and 943 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-framework-py-release
Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…
python-package-management
Guide for managing packages in the Agent Framework Python monorepo, including creating new connector packages, versioning, and the lazy-loading pattern. Use this when adding, modifying, or releasing packages.
foundry-hosted-agent-validation
Step-by-step process for validating a Python Foundry hosted agent sample (under python/samples/04-hosting/foundry-hosted-agents/) end to end — running it locally (native runtime and azd ai agent run) and after deploying it to an Azure AI Foundry project with azd. Use this when asked to validate a hosted agent sample.
verify-samples-tool
How to use the verify-samples tool to run, verify, and manage sample definitions in the Agent Framework repository. Use this when adding, updating, or running sample verification.
build-and-test
How to build and test .NET projects in the Agent Framework repository. Use this when verifying or testing changes.
python-feature-lifecycle
Guidance for package and feature lifecycle in the Agent Framework Python codebase, including stage meanings, feature-stage decorators, feature enums, and how to move APIs from one stage to the next.