Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tarekkharsa/agentstack/ship-workernpx skills add Tarekkharsa/agentstack --skill ship-workergit clone --depth 1 https://github.com/Tarekkharsa/agentstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00031 | $0.00634 |
| Opus 5 | $0.00015 | $0.00317 |
| Sonnet 5 | $0.00006 | $0.00127 |
| Haiku 4.5 | $0.00003 | $0.00063 |
Grade A, and why
cloudflare_ship_worker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship a Cloudflare Worker
Unofficial, agentstack-authored. Not affiliated with or endorsed by Cloudflare.
Use this skill when deploying a Cloudflare Worker (new or existing) and you want the deploy to be repeatable, reviewable, and safe to roll back.
Workflow
- Read
wrangler.toml(orwrangler.jsonc) end to end. Confirmname,main(the entry script), andcompatibility_dateare set. A missing or stalecompatibility_dateis the most common cause of surprising runtime behavior — set it to the day you are shipping unless the project pins one deliberately. - Inventory every binding the Worker needs and confirm it exists in config:
KV namespaces, R2 buckets, D1 databases, Queues, Durable Objects, service
bindings, and
vars. A binding referenced in code but absent from config fails at runtime, not at build. - Set secrets out of band with
wrangler secret put <NAME>— never commit them towrangler.tomlorvars. Verify withwrangler secret list. - Validate before shipping:
wrangler deploy --dry-run --outdir distbuilds the bundle without publishing. Read the binding summary it prints and confirm it matches step 2. - Deploy to the intended environment explicitly:
wrangler deployfor the default, orwrangler deploy --env staging/--env production. Do not let ambiguity decide which environment ships. - Verify the live deploy: hit the route or
workers.devURL, then tail logs withwrangler tailto confirm requests land and bindings resolve. - If anything looks wrong, roll back with
wrangler rollback(orwrangler deployments listthenwrangler rollback <id>) rather than hot-patching.
Conventions
- Use named environments (
[env.staging],[env.production]) instead of editing one shared config per deploy. Promote the same code across environments. - Keep
compatibility_dateandcompatibility_flagsunder version control so a deploy is reproducible from a clean checkout. - Prefer
--dry-runin CI as a fast build/config check on every PR.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 54 lines · 31 tokens per session scan A 976296205de7
cloudflare_ship_worker is a skill published in the GitHub repository Tarekkharsa/agentstack (3 stars, last pushed 19d ago), licensed Apache-2.0. It adds 31 tokens to every session and 634 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
lint-js
Lint JS/TS code only. Use before opening a PR when only JavaScript or TypeScript files were changed (no Rust).
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.
test
Detect the project’s test stack, run the narrowest useful tests, create tests when authorized, and report coverage/gaps honestly.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
stack-merge
Bulk-merge a Graphite stack into main via admin-bypass fast-forward push. Replaces the Graphite merge queue for rivet-dev/rivet. Invoke when the user says "merge the stack at ", "ship everything through ", "bulk-merge up to ", "fast-forward main to ", or any request to land multiple stacked PRs at once in one shot.…