Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add thettwe/nyann --skill sync-team-profilesgit clone --depth 1 https://github.com/thettwe/nyannWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thettwe/nyann/sync-team-profiles)<a href="https://agentmods.dev/skills/thettwe/nyann/sync-team-profiles"><img src="https://agentmods.dev/badge/skills/thettwe/nyann/sync-team-profiles/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thettwe/nyann/sync-team-profiles"><img src="https://agentmods.dev/badge/skills/thettwe/nyann/sync-team-profiles.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.01107 |
| Opus 5.5 | $0.00069 | $0.00443 |
| Sonnet 5.5 | $0.00034 | $0.00221 |
| Haiku 4.5 | $0.00017 | $0.00111 |
Grade A, and why
sync-team-profiles scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sync-team-profiles
Wraps bin/sync-team-profiles.sh.
On first run it shallow-clones each registered team-profile source
(git clone --depth=1); on subsequent runs it does a shallow fetch
(git fetch --depth=1) and git reset --hard FETCH_HEAD to advance
to the latest commit. Every profile under the cache is then validated
against profiles/_schema.json, and valid profiles are registered
under <source-name>/<profile-name>.
1. Pre-flight
- Config at
~/.claude/nyann/config.jsonmust have at least one entry inteam_profile_sources[]. If empty, route toadd-team-sourcefirst. - Uses the sync interval from each source. When the user says
"force refresh" / "ignore the interval" / "pull now", pass
--force. - When the user names a specific source ("sync just the platform-
team profiles"), pass
--name <source>so unrelated sources don't get pulled.
2. Invoke
bin/sync-team-profiles.sh \
[--user-root <dir>] \
[--force] \
[--name <source>]
Network operation. Expect up to a few seconds per source. The backend is resilient — a failing source logs the error and moves on to the next.
3. Interpret the JSON summary
Top-level shape is four arrays (see schemas/team-sync-result.schema.json):
synced[]— sources that pulled this run. Each entry:{name, synced_at}.skipped[]— sources within their interval window. Each entry:{name, reason: "within-interval", next_due}. Tell the user the next-due timestamp; they can re-run with--forceif they need to pull immediately.registered[]— every profile that passed schema validation. Each entry:{source, name, namespaced, path}. Thenamespacedfield is what to use withbootstrap-project --profile <namespaced>.invalid[]— anything that didn't make it through (fetch failure, clone failure, hand-edited config with a bad ref/url, TOCTOU on the cache dir, profile that fails schema validation). Each entry:{name|source, kind, error}wherekindis one ofinvalid-name,invalid-ref,invalid-url,fetch-failed,clone-failed,toctou,invalid-schema. Show these but don't treat any single one as fatal — the script logs and moves on to the next source.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 105 lines · 172 tokens per session scan A 91acbf224f86
sync-team-profiles is a skill published in the GitHub repository thettwe/nyann (7 stars, last pushed 3d ago), licensed MIT. It adds 172 tokens to every session and 1,107 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
daily-working
End-to-end pipeline: pull a task from the project's task tracker by ID (Redmine or GitHub Issues today, more addable via a new adapter), sanity-check and impact-assess it against the codebase before touching anything, implement it with the Claude CLI, verify the result in a real browser via the Claude Chrome extension…
chief-information-officer
The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering. Use this to set IT priorities, decide what IT owns versus engineering, structure IT spend or an IT roadmap, judge whether to build, buy or outsource, or work out why IT is seen as a cost…
service-desk
Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets…
chief-operating-officer
Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to…
head-of-pmo
The EPMO lead's remit — what the PMO governs, what it must never become, and how it earns standing rather than compliance. Use this to stand up or reform a PMO, decide what it should and should not control, judge whether it is adding value or overhead, or work out why teams route around it.
chief-product-officer
Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release. Use this to decide what to build next, to cut scope, to turn a business goal into a product bet, to judge whether a feature is worth its cost, or when engineering and go-to-market…