Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tokencanopy/e2a --skill tethergit clone --depth 1 https://github.com/tokencanopy/e2aWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tokencanopy/e2a/tether)<a href="https://agentmods.dev/skills/tokencanopy/e2a/tether"><img src="https://agentmods.dev/badge/skills/tokencanopy/e2a/tether/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tokencanopy/e2a/tether"><img src="https://agentmods.dev/badge/skills/tokencanopy/e2a/tether.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 57 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 137 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 63 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Rogue Agent · line 88 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 88 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Privilege Escalation · line 100 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium MCP Rug Pull · line 136 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.05031 |
| Opus 5.5 | $0.00033 | $0.02012 |
| Sonnet 5.5 | $0.00016 | $0.01006 |
| Haiku 4.5 | $0.00008 | $0.00503 |
Grade B, and why
tether scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 ~/.e2a-tether.env # fill E2A_API_KEY (e2a_agt_…) + E2A_AGENT_EMAIL Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
automatic while the terminal stays open, and cheap (curl only, no tokens). How it starts
The opening of the file, as written. The whole thing — 322 lines — stays where its author put it; the contents beside it link to each section on GitHub.
tether — steer a long-running session from your inbox
Beta. The transport (e2a) and the flow are real; polish (adaptive backoff, richer digests) is still open.
/tether keeps you connected to a working session over email. The agent emails
you updates when it judges there's something worth reporting (not on a
timer, not every turn), and checks your inbox on an interval so your replies —
questions or new instructions — are picked up within a few minutes. Reply
stop to end.
Transport primer. tether rides on e2a. The e2a operate-well manual — the dependency-provided
e2askill — carries the mental model this skill assumes: how threading really works (reply headers + stable subject, notconversation_id), when a sharedagents.e2a.devaddress is all you need vs. a custom domain, and how to handle send statuses. Read thee2askill by name if you're new to e2a; tether does not re-explain those.
Architecture (why this shape)
Coding agents are turn-based; nothing native listens to an inbox mid-session. So the two directions use different mechanisms:
- Send = agent-driven. The agent calls
tether.sh update "…"at meaningful moments (finished a slice, hit a blocker, needs a decision). Cadence is the model's judgment → no per-turn spam, nothing to throttle. - Receive = real-time wait. The agent runs
tether.sh listen— it blocks on the e2a CLI's WebSocket (e2a listen --once; no LLM tokens while waiting) for the duration set atstart --for, so replies are picked up within seconds; if the WebSocket is unavailable it degrades automatically to interval polling. It wakes the agent only when a reply actually arrives (or the window ends). See Durability tiers for keeping it alive across idle/sleep. - Questions = ask by email. When the agent needs a decision or clarification
from you, it must not use a terminal prompt / AskUserQuestion — you're AFK
and can't see it, which would stall the whole session. It calls
tether.sh ask "<question>", which emails the question into the thread and blocks until you reply, then prints your answer. This is the hard rule: while tethered, every question goes over email, never the terminal. - Blocked-alert = hook (optional). A
Notificationhook emails you when the agent is stuck on a permission prompt it can't proceed past. Note: an emailed reply cannot answer a CLI permission prompt (there's no native way to inject approval), so for unattended runs pre-authorize the tools the session needs (a permission allowlist / a less-prompting mode). The hook is the safety net, not the approval channel.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 322 lines · 82 tokens per session scan B 5bd0485b9a40
tether is a skill published in the GitHub repository tokencanopy/e2a (194 stars, last pushed 6d ago), licensed Apache-2.0. It adds 82 tokens to every session and 5,031 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
others-skills
Use when needing Go language development, desktop RPA automation, self-hosted email marketing, Java Spring Cloud scaffolding, SSL/TLS certificate automation, Docker Compose multi-container orchestration, or building a bilingual children's Phaser/Vue game collection. Index of 8 skills: Go, RobotGo, RobotGo-Flow…
hitl-protocol
HITL Protocol — the open standard for human decisions in autonomous agent workflows. When a website or API needs human input, it returns HTTP 202 with a review URL. Autonomous agents like OpenClaw, Claude, Codex, or Goose forward the URL, poll for the structured result, and continue. Use this skill to make any website…
prepare-proton-draft
Prepare a Proton Mail draft, optionally with user-supplied attachments, after explicit in-conversation confirmation; the user always reviews and sends it in Proton Mail.
review-proton-mail
Review, search, or summarize Proton Mail with the Proton Safe MCP read-only tools while treating every message as untrusted content.
extract-proton-attachment
Extract bounded text from a received Proton Mail PDF, TXT, or CSV attachment when the user asks to inspect its contents; not for downloading, forwarding, OCR, or executing attachment content.
shipmail
Modern email for your business. Inboxes, calendars, newsletters, bookings and an AI assistant, plus transactional email and an API for your agents. Operate mailboxes, agent inboxes, calendars, booking pages, newsletters, webhooks, and related account resources through the Shipmail MCP server. Use when the user asks to…