Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/trippyogi/gitworthy/gitworthynpx skills add trippyogi/gitworthy --skill gitworthygit clone --depth 1 https://github.com/trippyogi/gitworthyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02151 |
| Opus 5 | $0.00000 | $0.01076 |
| Sonnet 5 | $0.00000 | $0.00430 |
| Haiku 4.5 | $0.00000 | $0.00215 |
Grade A, and why
gitworthy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
gitworthy skill
Use gitworthy before spending time on an external repository issue or feature request.
Mandatory contribution loop
Never invert this order. Scout and execute are separate lanes; execute never skips gates.
1. contrib_policy → 2. hunt/scan (optional) → 3. worth_check
↓
4. ledger record / claim intent → 5. worth_check again (apply-lane revalidation)
↓
6. fork → 7. repro → 8. implement → 9. review → 10. PR or comment
Gate 1: contrib_policy before fork, implement, or PR
Run contribution policy before forking, cloning for implementation, or opening a PR:
npx gitworthy policy owner/repo --json
Or use npx gitworthy scan owner/repo --json / npx gitworthy hunt … only as tracker triage; follow policy reminders when no cached policy exists.
Do not fork or implement until policy is read and the contribution path is chosen (see path matrix below).
Gate 2: Path matrix from policy signals
Pick exactly one contribution path from contrib_policy evidence before investing:
| Path | When to use | Deliverable |
|---|---|---|
| pr | Default when policy allows PRs; no no_pr_path; no security-only channel |
Fork → branch → PR |
| issue_comment_patch | issue_first_or_alignment in policy; or no_pr_path with a forum/discussion/issue feedback channel |
Repro + minimal patch or steps in an issue comment (or linked discussion) |
| security_report | SECURITY.md or policy excerpt requires private disclosure |
Report via stated channel; do not open a public PR for the vulnerability |
| skip | worth_check SKIP; or no_pr_path with no actionable alternate channel; or policy forbids the change type |
Do not invest; pick the next queue item |
When no_pr_path is present, read feedback_channel in evidence and map it to issue_comment_patch or security_report — never default to pr.
Gate 3: Hunt loop (perf)
Wall time is usually N × worth_check, not one slow check. Prefer a narrow funnel:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 147 lines · 0 tokens per session scan A 612aeb982426
gitworthy is a skill published in the GitHub repository trippyogi/gitworthy (2 stars, last pushed 11d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,151 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…