Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tracer-cloud/opensre/github-star-velocitynpx skills add Tracer-Cloud/opensre --skill github-star-velocitygit clone --depth 1 https://github.com/Tracer-Cloud/opensreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.00565 |
| Opus 5 | $0.00012 | $0.00282 |
| Sonnet 5 | $0.00005 | $0.00113 |
| Haiku 4.5 | $0.00002 | $0.00056 |
Grade A, and why
github-star-velocity scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Star Velocity
Use this skill only when the dedicated get_github_star_history tool is not
available. When that tool is available, prefer it for GitHub star velocity,
stars gained in a recent window, day-by-day stars, star growth rate, or similar
metrics for a repository.
Prerequisites
- Set
allow_network: trueonexecute_python_code. - Read
GITHUB_TOKENfrom the subprocess environment (injected when GitHub credentials are configured). Never print the token. - Parse
owner/repofrom the repository URL or user input.
API approach
- Fetch current
stargazers_countfromGET /repos/{owner}/{repo}. - Fetch stargazers with timestamps from
GET /repos/{owner}/{repo}/stargazers?per_page=100usingAccept: application/vnd.github.v3.star+json. - Each entry includes
starred_at. Count stars wherestarred_atis within the requested window.
Critical pagination trap
Stargazers are returned oldest first, not newest first. Do not stop after the first page when the newest entries on that page fall outside the window — that produces a false zero.
For responsiveness, compute the last page from stargazers_count and
per_page=100, fetch newest pages by explicit page number in descending
order, and stop once the oldest starred_at on a fetched page is before the
window start. Only run a full historical scan when the user explicitly asks for
all-time history or an audit-quality export.
Sanity check before reporting
Treat these results as suspicious and rerun with a full paginated scan before answering:
0stars in the last 24 hours for a repo with thousands of stars and recent activity- Velocity that implies losing stars without an explicit unstar request
- Counts that disagree sharply with
stargazers_countdeltas when you have a recent baseline
When a result looks wrong, widen the scan (all pages), print the most recent
starred_at observed, and only then return the velocity.
Output shape
Return:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 67 lines · 23 tokens per session scan A dbea8168129e
github-star-velocity is a skill published in the GitHub repository Tracer-Cloud/opensre (10,985 stars, last pushed yesterday), licensed Apache-2.0. It adds 23 tokens to every session and 565 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
host_bash
设备上跑只读 shell 命令做诊断探索(沙箱化 / read-only policy).
host_restart_service
重启允许列表内的 systemd service(mutating,触发 reviewer 二审).
file_inspector
Inspect files on the host filesystem.
edge_disk_audit
Audit disk usage on edge devices.
hello-world
Skill whose name uses a dash, expected to be normalized.
future_skill
A skill that uses fields ongrid does not yet recognize.