Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add thettwe/nyann --skill fleet-retrofitgit clone --depth 1 https://github.com/thettwe/nyannWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thettwe/nyann/fleet-retrofit)<a href="https://agentmods.dev/skills/thettwe/nyann/fleet-retrofit"><img src="https://agentmods.dev/badge/skills/thettwe/nyann/fleet-retrofit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thettwe/nyann/fleet-retrofit"><img src="https://agentmods.dev/badge/skills/thettwe/nyann/fleet-retrofit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00168 | $0.01243 |
| Opus 5 | $0.00084 | $0.00622 |
| Sonnet 5 | $0.00034 | $0.00249 |
| Haiku 4.5 | $0.00017 | $0.00124 |
Grade A, and why
fleet-retrofit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
fleet-retrofit
Plugin root:
<plugin_root>/skills/fleet-retrofit/SKILL.md— the planning/bookkeeping engine is<plugin_root>/bin/fleet-retrofit.sh; per-repo mutation reuses the SAME scripts the single-repo flows use.
The safety contract (non-negotiable): every mutation happens through
the per-repo preview-and-confirm chain — plan → preview.sh → an
AskUserQuestion for THAT repo → SHA-bound bootstrap.sh. There is no
"yes to all": a fleet-wide approval would skip previews, which nyann never
does. Each repo writes its own BootRecord, so any repo is individually
reversible via /nyann:undo-bootstrap. In a non-interactive context
(NYANN_NONINTERACTIVE=true / CI), stop after the plan and report — bulk
mutation without a human cannot happen, by construction.
1. Plan
run_file=$(mktemp -t nyann-fleet-run.XXXXXX)
bin/fleet-retrofit.sh --plan [--bootstrap-missing] [--tag t] [--only a,b] \
--run-file "$run_file"
The plan classifies every registry entry — clean, drifted (report-only
drift computation), ungoverned (no boot record and no resolvable
profile), or error — read-only, one broken repo never aborts it.
Exit 0 means nothing to do: report "fleet is clean" and stop.
Include --bootstrap-missing only when the user asked to set up new repos
too ("bootstrap all my repos", "including the ones nyann never touched").
If they didn't say and the plan shows ungoverned repos being skipped,
mention the count and ask once whether to re-plan with the flag.
2. Confirm the scope
Show the plan summary (drifted / ungoverned / clean / error counts and the worst repos) and confirm with ONE AskUserQuestion that the user wants to walk the fleet. Offer "stop here" — the plan alone is a useful artifact.
3. Walk the repos (plan order — worst first)
For each pending repo, work inside that repo's path (every --target
below is the fleet entry's path, and the profile is the plan row's
profile):
drifted→ follow the remediation flow inskills/retrofit/SKILL.md§5 verbatim (ActionPlan from the drift report →route-docs.sh→render-plan.sh→preview.sh→ confirm →bootstrap.sh --plan-sha256 <sha> --source retrofit). Do not re-derive it here — the single-repo skill is the source of truth.ungoverned(only with--bootstrap-missing) → followskills/bootstrap-project/SKILL.mdfor that path:suggest-profile.shpicks the profile (confirm the pick when confidence is low), then the standard detect → plan → preview → confirm →bootstrap.shchain.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 108 lines · 168 tokens per session scan A 926809040690
fleet-retrofit is a skill published in the GitHub repository thettwe/nyann (6 stars, last pushed 13d ago), licensed MIT. It adds 168 tokens to every session and 1,243 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
daily-working
End-to-end pipeline: pull a task from the project's task tracker by ID (Redmine or GitHub Issues today, more addable via a new adapter), sanity-check and impact-assess it against the codebase before touching anything, implement it with the Claude CLI, verify the result in a real browser via the Claude Chrome extension…
catchup
Summarize and review what changed while you were away. Use after a weekend, vacation, or flight to check missed PRs, git commits, Linear tickets, and meetings — one prioritized brief, not a firehose.
phx-deps-update
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).
new-work
Create and manage todo tracking documents for features, bugs, and multi-step tasks. Use when starting new work that benefits from a persistent record of decisions, progress, and context.
chief-operating-officer
Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to…
chief-product-officer
Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release. Use this to decide what to build next, to cut scope, to turn a business goal into a product bet, to judge whether a feature is worth its cost, or when engineering and go-to-market…