Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/team-commonly/commonly/githubnpx skills add Team-Commonly/commonly --skill githubgit clone --depth 1 https://github.com/Team-Commonly/commonlyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00049 | $0.00952 |
| Opus 5 | $0.00024 | $0.00476 |
| Sonnet 5 | $0.00010 | $0.00190 |
| Haiku 4.5 | $0.00005 | $0.00095 |
Grade A, and why
github scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
github — GitHub via the gh CLI
The gh CLI is installed on PATH. The gateway environment provides a
GITHUB_PAT env var (a Team-Commonly fine-grained PAT with repo + PR scope)
which gh picks up automatically as GH_TOKEN.
The active GitHub identity is Team-Commonly bot identity — anything you push, comment, or open will be attributed to that account.
No shell? Don't use
gh. Theghexamples below assume a real shell (codex / claude-code runtimes). OpenClaw runtimes (theo/nova/pixel/ops) have no shell and cannot runghat all. For those agents:
- Read a PR diff:
web.fetchthe raw public diff athttps://patch-diff.githubusercontent.com/raw/Team-Commonly/commonly/pull/<N>.diff.- Post a review verdict: write it into the dev pod chat (read-only review).
- codex / claude-code runtimes have a shell: use
ghdirectly, as below.There is deliberately no
commonly_pr_*MCP tool. The pair that existed was removed because it spent a shared server-side credential on a caller-chosen repository, so any agent could review any repo that credential reached.ghacts as the machine's own GitHub identity and supports line-level comments, which those tools never did.
Common operations
Issues
# List open issues in a repo
gh issue list --repo Team-Commonly/commonly --state open
# Create an issue
gh issue create --repo Team-Commonly/commonly \
--title "Title here" \
--body "Body here"
# Comment on an issue
gh issue comment 123 --repo Team-Commonly/commonly --body "comment"
Pull requests
# List open PRs
gh pr list --repo Team-Commonly/commonly --state open
# View a PR (diff, comments, status)
gh pr view 287 --repo Team-Commonly/commonly --json title,body,additions,deletions
# Get a PR's diff
gh pr diff 287 --repo Team-Commonly/commonly
# Comment on a PR
gh pr comment 287 --repo Team-Commonly/commonly --body "comment text"
# Check CI status
gh pr checks 287 --repo Team-Commonly/commonly
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 112 lines · 49 tokens per session scan A 804a70811466
github is a skill published in the GitHub repository Team-Commonly/commonly (1,323 stars, last pushed 2d ago), licensed Apache-2.0. It adds 49 tokens to every session and 952 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-pr
Review a Dograh pull request, branch diff, or pasted patch for repo-specific security and correctness risks that are not obvious from generic FastAPI, Next.js, or Python conventions. Use when the user asks to review a PR, audit a diff, check whether changes are safe to merge, review their own changes, or asks what to…
review-agents-md
Audit Dograh AGENTS.md files for drift against the live repo and for bad scope boundaries between parent and child docs. Use when the user asks to review existing AGENTS files, identify stale guidance, decide whether a subtree needs its own AGENTS.md, or update the AGENTS.md hierarchy under the repo root, api/, or ui/.
merge-pipecat-upstream
Merge the latest upstream pipecat-ai/pipecat tag into the pipecat submodule fork (dograh-hq/pipecat) and bump the dograh repo to it. Use whenever the user asks to bump, upgrade, sync, or merge pipecat, resolve pipecat merge conflicts, audit whether upstream changes break or supersede Dograh's in-fork patches, or…
experiment-tracking-swanlab
Provides guidance for experiment tracking with SwanLab. Use when you need open-source run tracking, local or self-hosted dashboards, and lightweight media logging for ML workflows.
review-polish
The before-review and before-handoff pass for RomM, covering both stacks. First shapes the code the checks can't see — comment and docstring discipline (the single most-corrected thing in this repo), duplicated constants/types/getters, imprecise names, loose typing in tests. Then runs the verification gate that keeps…
frontend-v2-components
Building or modifying components in the RomM v2 frontend (frontend/src/v2/). Use when creating/editing v2 primitives (R components in src/v2/lib/), shared composites, or feature composites — covers the three-tier model, file/folder conventions, SFC structure, import order, barrels, Storybook requirements, and v2…