Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/twells89/sigma-migration-skillsnpx agentmods add skills/twells89/sigma-migration-skills/hex-to-sigmaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/twells89/sigma-migration-skills/hex-to-sigma)<a href="https://agentmods.dev/skills/twells89/sigma-migration-skills/hex-to-sigma"><img src="https://agentmods.dev/badge/skills/twells89/sigma-migration-skills/hex-to-sigma/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/twells89/sigma-migration-skills/hex-to-sigma"><img src="https://agentmods.dev/badge/skills/twells89/sigma-migration-skills/hex-to-sigma.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.04496 |
| Opus 5 | $0.00036 | $0.02248 |
| Sonnet 5 | $0.00014 | $0.00899 |
| Haiku 4.5 | $0.00007 | $0.00450 |
Grade A, and why
hex-to-sigma scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 337 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hex → Sigma
Status: live-validated through Phase 6 (2026-07-30). DM POST + readback, workbook POST + readback, layout lint, the deeper compiled-SQL check (
sigma-workbooks/scripts/verify-workbook.sh), a visual PNG export, AND numeric parity all passed clean against a real Sigma org — 8/8 DM columns, 10/10 workbook columns, 6/6 elements, zerotype=error, zero unresolved/circular formula refs, KPI values confirmed exact ($39,759,625.52/91,206), and the visual layout matches the original Hex app (verified via PNG export, not just eyeballing the live UI).corpus/hex/commerce/covers the structural regression test (no live org needed to re-run it). That live run predates the released wrapper/flat-element payload; the migrated payload is offline-tested and still requires a fresh live POST/readback/PNG pass before extending the live-validation claim to it.
Phase numbering is local to this skill; the canonical Assess→Discover→ Reuse→Convert→Post-DM→Build→Layout→Parity→Security→Enhance arc and this skill's mapping live in
docs/phase-schema.md(full clone only — see repodocs/phase-schema.md).
Read
refs/hex-file-schema.json(the vendored public JSON Schema for Hex's.hex.yamlformat) before relying on a cell shape not covered below — it's the actual source of truth, not this document.
Why discovery is different here
Hex's public REST API (learn.hex.tech/docs/api/api-overview) covers
projects/runs/users/collections/data-connections — it does not return
cell content (no SQL text, no chart config). There is no endpoint
equivalent to Metabase's GET /api/card/{id} or Cognos's data-module JSON.
The actual source of truth for a project's full logic is Hex's .hex.yaml
project export — a full-fidelity file (every cell + the app layout),
obtained via a one-click manual Export from the project dropdown (any
plan, no credentials) or continuous Git Sync (Team/Enterprise — same
format, synced to a repo instead of a one-off download). There's a public,
versioned JSON Schema for it at https://static.hex.site/hex-file-schema.json
(registered on SchemaStore), vendored locally at refs/hex-file-schema.json.
What ships with it
50 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- converter/convert_dm.py 7.4 KB runs code
- converter/convert_workbook.py 22 KB runs code
- converter/hex_yaml.py 8.1 KB runs code
- converter/sigma_ids.py 5.2 KB runs code
- fixtures/commerce-dashboard.hex.yaml 23 KB
- QUICKSTART.md 106 B
- refs/app-recommendation-signals.md 3.1 KB
- refs/catalogs/viz-kind.json 4.2 KB
- refs/catalogs/workbook-feature.json 5.4 KB
- refs/hex-file-schema.json 124 KB
- refs/layout-visual-qa.md 104 B
- refs/phase-e-enhance.md 12 KB
- schemas/app-plan.schema.json 3.0 KB
- scripts/assert-phase6-ran.rb 254 KB runs code
- scripts/cleanup-orphan-workbooks.rb 11 KB runs code
- scripts/enhance-app-plan.rb 8.1 KB runs code
- scripts/enhance-apply.rb 48 KB runs code
- scripts/enhance-scan.rb 38 KB runs code
- scripts/enhance-select.rb 5.3 KB runs code
- scripts/escalate-gap.py 9.8 KB runs code
- scripts/find-or-pick-dm.rb 29 KB runs code
- scripts/get_token.py 8.2 KB runs code
- scripts/get-token.sh 4.4 KB runs code
- scripts/lib/anchor_values.rb 5.6 KB runs code
- scripts/lib/blind_grade.rb 8.8 KB runs code
- scripts/lib/cli_encoding.rb 1.8 KB runs code
- scripts/lib/code_rep.mjs 7.9 KB runs code
- scripts/lib/code_rep.py 9.3 KB runs code
- scripts/lib/code_rep.rb 11 KB runs code
- scripts/lib/control_lint.rb 22 KB runs code
- scripts/lib/degradation_ledger.rb 20 KB runs code
- scripts/lib/destination_resolver.rb 1.5 KB runs code
- scripts/lib/enhance_options.rb 18 KB runs code
- scripts/lib/evidence_ledger.rb 6.9 KB runs code
- scripts/lib/layout_lint.rb 15 KB runs code
- scripts/lib/preflight_lint.rb 30 KB runs code
- scripts/lib/ruby_compat.rb 2.9 KB runs code
- scripts/lib/sigma_rest.rb 14 KB runs code
- scripts/lint-render-integrity.rb 11 KB runs code
- scripts/post-and-readback.rb 7.8 KB runs code
- scripts/probe-controls.rb 23 KB runs code
- scripts/record-visual-check.rb 21 KB runs code
- scripts/sigma-export-png.py 5.1 KB runs code
- scripts/tests/test_post_and_readback.rb 6.3 KB runs code
- scripts/verify-anchors.rb 58 KB runs code
- scripts/verify-warehouse.rb 9.1 KB runs code
- tests/test_convert_dm.py 5.0 KB runs code
- tests/test_convert_workbook.py 17 KB runs code
- tests/test_hex_yaml.py 7.1 KB runs code
- tests/test_sigma_ids.py 4.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 337 lines · 72 tokens per session scan A 2a5a6b93d9f0
hex-to-sigma is a skill published in the GitHub repository twells89/sigma-migration-skills (16 stars, last pushed yesterday), licensed MIT. It adds 72 tokens to every session and 4,496 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…