Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tma1-ai/tma1 --skill tma1-setupgit clone --depth 1 https://github.com/tma1-ai/tma1Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tma1-ai/tma1/tma1-setup)<a href="https://agentmods.dev/skills/tma1-ai/tma1/tma1-setup"><img src="https://agentmods.dev/badge/skills/tma1-ai/tma1/tma1-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tma1-ai/tma1/tma1-setup"><img src="https://agentmods.dev/badge/skills/tma1-ai/tma1/tma1-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.03336 |
| Opus 5 | $0.00032 | $0.01668 |
| Sonnet 5 | $0.00013 | $0.00667 |
| Haiku 4.5 | $0.00006 | $0.00334 |
Grade D, and why
tma1-setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://tma1.ai/install.sh | bash Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
**Claude Code** — merge into `~/.claude/settings.json` (Windows: `%USERPROFILE%\.claude\settings.json`): Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sf http://localhost:14318/health How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TMA1 Setup
You are helping the user install and configure TMA1, a local-first LLM agent observability tool.
Step 1: Check if TMA1 is already running
curl -sf http://localhost:14318/health
If this returns {"status":"ok"}, TMA1 is already running. Skip to Step 4.
Step 2: Install TMA1
Download and install the tma1-server binary:
# macOS / Linux
curl -fsSL https://tma1.ai/install.sh | bash
# Windows (PowerShell)
irm https://tma1.ai/install.ps1 | iex
This installs the binary to ~/.tma1/bin/tma1-server (or %USERPROFILE%\.tma1\bin\tma1-server.exe on Windows).
Step 3: Start TMA1
On macOS/Linux the installer registers a service that auto-starts. On Windows the installer registers a Scheduled Task that auto-starts.
If TMA1 is not running, start it manually:
# macOS / Linux
~/.tma1/bin/tma1-server &
# Windows (PowerShell)
Start-Process "$env:USERPROFILE\.tma1\bin\tma1-server.exe"
Wait for GreptimeDB to become healthy:
# macOS / Linux
for i in $(seq 1 30); do
if curl -sf http://localhost:14318/health > /dev/null 2>&1; then
echo "TMA1 is ready."
break
fi
sleep 1
done
# Windows (PowerShell)
for ($i = 0; $i -lt 30; $i++) {
try { if ((Invoke-WebRequest -Uri http://localhost:14318/health -UseBasicParsing).StatusCode -eq 200) { Write-Host "TMA1 is ready."; break } } catch {}
Start-Sleep -Seconds 1
}
If it does not become healthy after 30 seconds, check the logs and report the error.
Step 4: Verify OTel endpoint
Confirm GreptimeDB is accepting OTLP data:
curl -sf http://localhost:14318/status
This should return {"status":"ok","greptimedb":"running",...}.
Step 5: Configure the agent
Tell the user to set the OTel exporter endpoint. The exact method depends on their agent:
Claude Code — merge into ~/.claude/settings.json (Windows: %USERPROFILE%\.claude\settings.json):
CRITICAL: You MUST read the existing
settings.jsonfirst and MERGE — NEVER overwrite.
- For
"env": add/update only the keys shown below. Keep all existing env vars intact.- For
"hooks": for each event type, append the TMA1 hook entry to the existing array. Do NOT replace the array or remove other hooks.- For all other top-level keys (
permissions,mcpServers,enabledPlugins, etc.): do NOT touch them.Example merge for a hook event that already has entries:
"PreToolUse": [ { "hooks": [{ "type": "command", "command": "existing-hook.sh" }] }, { "hooks": [{ "type": "command", "command": "~/.tma1/hooks/tma1-hook.sh", "timeout": 3 }] } ]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 264 lines · 64 tokens per session scan D fa727f59a6d9
tma1-setup is a skill published in the GitHub repository tma1-ai/tma1 (117 stars, last pushed 6d ago), licensed Apache-2.0. It adds 64 tokens to every session and 3,336 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
clawmetry-selfcheck
Read your own agent telemetry from ClawMetry (waste, progress, cost) and act on it before finishing a task. Use when ClawMetry is installed on this machine and you want to check whether you are re-reading files, spinning in loops, or burning budget.
clawmetry
Real-time observability for OpenClaw agents — local dashboard + optional encrypted cloud sync. Tracks costs, tokens, sessions, tool calls, memory, crons, and system health. Access from anywhere via ClawMetry Cloud.
agent-kill-switch
Give the human an off switch and a cost meter for the coding agents on this machine, using ClawMetry. Use when the user asks to stop or kill a runaway agent, see what an agent is doing or spending, cap agent spend, gate risky tool calls behind approval, or "set up a kill switch" for Claude Code, Codex, Cursor, Gemini…
douyin-skills
A local automation toolkit for Douyin, the Chinese short-video platform, and its creator center. It uses the computer’s Chrome browser to handle account access, content search, publishing, and basic interactions.
douyin-env
An environment setup and troubleshooting guide for the Douyin automation toolkit. It checks the computer’s Python, Node.js, browser, dependencies, graphics support, and local browser profile.
douyin-publish
A browser workflow for preparing and publishing image posts or videos on Douyin, a Chinese short-video social platform. It uploads local media, fills the post details, checks the page, and publishes only after confirmation.