Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tomzx/agents --skill initialize-developer-trust-profilegit clone --depth 1 https://github.com/tomzx/agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tomzx/agents/initialize-developer-trust-profile)<a href="https://agentmods.dev/skills/tomzx/agents/initialize-developer-trust-profile"><img src="https://agentmods.dev/badge/skills/tomzx/agents/initialize-developer-trust-profile/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tomzx/agents/initialize-developer-trust-profile"><img src="https://agentmods.dev/badge/skills/tomzx/agents/initialize-developer-trust-profile.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01694 |
| Opus 5.5 | $0.00013 | $0.00678 |
| Sonnet 5.5 | $0.00007 | $0.00339 |
| Haiku 4.5 | $0.00003 | $0.00169 |
Grade A, and why
initialize-developer-trust-profile scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Initialize Developer Trust Profile
Bootstraps a developer trust profile by processing the last N PRs authored by a developer across all repositories visible to gh (not a single repo), delegating each one to /developer-trust-profile.
Samples both merged and rejected PRs to avoid survivorship bias, and derives the outcome from actual review data rather than assuming all merged PRs are clean approvals.
Optionally pass --orgs followed by one or more GitHub organization logins to restrict results to PRs in repos owned by those orgs (or use multiple --owner flags in the commands below).
Omit --orgs to consider PRs in any repo the token can access.
Prerequisites
ghCLI authenticated with read access to the repositories you expect to search (public repos work without extra scope; private repos need appropriate token access)$1: GitHub username of the developer$2(optional): number of PRs to scan (default: 10). Must be a positive integer if provided.--orgs(optional): one or more organization names; only PRs under those orgs are included
Workflow
Resolve arguments
|
Build optional --owner flags from org list
|
Fetch merged PRs + closed-without-merge PRs (global or org-scoped)
|
Merge, sort by date, take most recent N
|
Any PRs found?
/ \
No Yes
| |
Stop For each PR (oldest first):
|
Fetch reviews
|
Determine outcome
(approved / not_approved)
|
/developer-trust-profile
{username} --after-review
{repo} {pr_number} {outcome}
|
Report summary
Steps
1. Resolve arguments
GITHUB_USERNAME: first positional argumentCOUNT: second positional if it is a positive integer, otherwise default10ORGS: empty unless--orgsappears; every token after--orgsuntil the end of the argument list is an organization login (e.g.acme-corp,myorg)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago Changed · +13 lines 56bfdd7ee1d1
- 24d ago Changed 1255e053baae
- 1mo ago First seen · 176 lines · 33 tokens per session scan A 13903192d62a
initialize-developer-trust-profile is a skill published in the GitHub repository tomzx/agents (13 stars, last pushed yesterday), licensed MIT. It adds 33 tokens to every session and 1,694 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
create-pr
Creates a GitHub PR with a Linear-ticket-prefixed title and a decision-led, narrative description for Prisma 8. Use when the user wants to create a pull request, open a PR, or submit changes for review.
git-commit
Generate well-formatted git commit messages following conventional commit standards.
repo-sync
Manage automatic Git syncing on macOS with repo-sync. Use only when the user explicitly invokes /repo-sync.
mcore-split-pr
Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.
engineer-bot-ops
A workflow for carrying an engineering task from scope through implementation and reviewable delivery. It works with a repository's branch, existing changes, rules, checks, and permissions while separating completed, unverified, and next-step work.
contributing
How to contribute to evlog, covering commit and PR conventions, changesets, the Definition of Done, testing rules, and the authored skills that walk through building a new adapter, enricher, framework integration, or map rule. Load this for any question about contributing, opening a PR, or adding something to the…