Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TypedDevs/bashunit --skill gh-issuesgit clone --depth 1 https://github.com/TypedDevs/bashunitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/typeddevs/bashunit/gh-issues)<a href="https://agentmods.dev/skills/typeddevs/bashunit/gh-issues"><img src="https://agentmods.dev/badge/skills/typeddevs/bashunit/gh-issues/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/typeddevs/bashunit/gh-issues"><img src="https://agentmods.dev/badge/skills/typeddevs/bashunit/gh-issues.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 64 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 131 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.00730 |
| Opus 5.5 | $0.00015 | $0.00292 |
| Sonnet 5.5 | $0.00007 | $0.00146 |
| Haiku 4.5 | $0.00004 | $0.00073 |
Grade A, and why
gh-issues scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Process an issue queue
Process open issues that are unassigned or assigned only to the authenticated user, oldest first, using gh-issue sequentially. Accept --limit N, --label foo, and --dry-run (discovery only).
Discover
Resolve the current login with gh api user -q .login. Fetch open issues with pagination:
gh api --paginate 'repos/{owner}/{repo}/issues?state=open&per_page=100'
Exclude pull requests, issues assigned to anyone else, and tracker issues whose body lists child issues. Deduplicate by number, apply the label filter, sort by created_at, then apply the requested limit. Print #<number> <title> [unassigned|@me]; stop if empty. Dry-run stops here.
Process
- Check
git status --porcelain. Preserve dirty work and stop or use an isolated worktree; never auto-stash or reset it. Fetch main and update a clean main withgit pull --ff-only. A divergent branch needs a deliberate resolution. - Choose the validation mode in step 3 before invoking
gh-issue. Re-read each issue's state and assignees before starting; skip closed or newly assigned issues. Invokegh-issue, which owns implementation, the canonical quality gate, commit, and PR. The coordinator runs that gate once per complete issue; delegates run only focused checks. - If strict-mode coverage is required by CI, use
./bashunit --parallel --simple --strict tests/in place of the ordinary parallel gate before committing. Inspect the current CI command first. Simple mode emits marker output; assert on helpers when testing full messages. Under strict mode, useifinstead of failing[ condition ] && assignment, initialize arrays with=(), read potentially empty elements as${arr[i]:-}, and keepextdebuginside a capture subshell. - Wait for
gh pr checks --watch. Investigate red checks, including Bash 3.0 compatibility. Re-run an identified infrastructure failure withgh run rerun <id> --failed; do not classify every registry failure as transient. If a local failure appears unrelated, compare the relevant test on unchanged main in an isolated checkout before claiming it predates the change. - Merge only when the user's authorization covers it and checks and branch protection allow it. Do not bypass protection. After an authorized merge, verify issue closure; close a completed issue if needed and update its parent's checklist. Escape Markdown brackets as literals when editing checkbox text and preserve the rest of the body.
- Delete merged branches and worktrees according to the global cleanup rules, fetch and prune, and fast-forward main before the next issue. Keep branches with open PRs or unpushed commits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · -134 lines 7cd8423a0d8c
- 1mo ago First seen · 168 lines · 37 tokens per session scan A 847d6dcaf007
gh-issues is a skill published in the GitHub repository TypedDevs/bashunit (435 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 730 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lovable
Lovable MCP tool usage — deploy projects, message agent, test with agent-browser. Minimize credits by delegating to local repo.
agent-browser
Browser automation via Chrome/Chromium CDP — open, snapshot, click, screenshot. For testing web apps, mobile layouts, and automated interactions without Playwright/Puppeteer.
verify-ui-change-in-cloud
Verifies user-facing Warp client changes by spawning a cloud agent with computer use to test Warp. Use only when the user explicitly requested computer-use verification or accepted an offer to run it, and ONLY in non-sandboxed environments and local environments. Triggers a cloud agent that runs the test-warp-ui skill.
test-warp-ui
Guides testing Warp UI features and changes using the computer use tool. Use this skill only when computer-use testing was requested (explicit request or accepted offer) and the computeruse tool is available to the agent. Covers launching Warp and verifying UI behavior.
tui-test
Control, inspect, test, and record real terminal apps with the tui-test CLI or its Rust, Python, and JavaScript APIs. Use for shells, TUI apps, text and style locators, keyboard or mouse input, terminal state, clipboard waits, screenshots, recordings, snapshots, and live terminal sessions.
JUnit 5 Testing
Production-grade Java unit and integration testing with JUnit 5 covering assertions, parameterized tests, lifecycle hooks, Mockito mocking, nested tests, and extensions.