Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ufna/vikunja-mcp/trackernpx skills add ufna/vikunja-mcp --skill trackergit clone --depth 1 https://github.com/ufna/vikunja-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ufna/vikunja-mcp/tracker)<a href="https://agentmods.dev/skills/ufna/vikunja-mcp/tracker"><img src="https://agentmods.dev/badge/skills/ufna/vikunja-mcp/tracker.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00045 | $0.31634 |
| Opus 5 | $0.00023 | $0.15817 |
| Sonnet 5 | $0.00009 | $0.06327 |
| Haiku 4.5 | $0.00005 | $0.03163 |
Grade C, and why
tracker scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
the whole scratchpad (`find <scratchpad> -name __pycache__ -exec rm -rf`, "let me tidy up How it starts
The opening of the file, as written. The whole thing — 1,486 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working with the tracker (Vikunja)
Pipeline: Backlog → Queue → Design → Build → Review → [human] → Done,
plus a separate Your Call column (YC in shorthand) and Icebox — the freezer, off to the
right of Done: very minor / legacy cards nobody is expected to pick up. next_task never
offers one while it sits there, so the column is the gate; the icebox LABEL is not a gate at
all — a card a human drags into Queue is offered like any other, carrying the label as an
instruction to do the MINIMUM that is correct. File a finding there yourself with
file_task(icebox=True) (see references/decompose.md). What no tool of yours does is take a
card OUT: return_task, decompose and transfer_task all refuse from Icebox, like they do
from Done. A frozen card stays readable and commentable, so a finding about one goes in a
comment on it — and if you think the freeze was wrong, say so in your report and leave it. Boards created before the freezer
existed simply have no such column, and everything else keeps working; only icebox=True
refuses there, naming vikunja-mcp setup. The hard rules are wired into the MCP
tools — they refuse if something is off. These rules are about HOW to work.
Which copy of these rules you are reading
The text the skill serves is a SNAPSHOT. The installed copy (~/.claude/skills/tracker/SKILL.md)
is rewritten from the package by sync_installed_artifacts, and it does that EXACTLY AT MCP
SERVER START, and a session's server starts once. So inside a session this text DOES NOT MOVE —
even if the rules were changed, landed and rolled out during that same session. (The
SessionStart hook's standing context is frozen by the same snapshot: its prose lives in
setup_cmd.render_hook_script and is synced by the same call.)
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +10 lines 768cc67ca5e9
- yesterday Changed · +34 lines e933738ccd7b
- 5d ago First seen · 1,442 lines · 45 tokens per session scan C 5055ccf95e33
tracker is a skill published in the GitHub repository ufna/vikunja-mcp (3 stars, last pushed today), licensed MIT. It adds 45 tokens to every session and 31,634 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
testing-rate-limiting
Apply deterministic SlowAPI rate-limiter isolation for FastAPI transport tests, especially to avoid flaky HTTP 429 responses.
Skill Creator
Create new Cursor Skills following the standard directory structure.
collattice
Operate a Collattice kanban board through its Model Context Protocol (MCP) endpoint — connecting, authentication, the board model, identifier rules (board-level reads need a board GUID, not a slug), the Markdown a board renders, and the full tool reference: reading and creating cards, moving and reordering lanes…
Code Quality Review
Conduct a comprehensive code quality review focused on clean code, architecture, and project standards.
Security Review
Conduct a thorough security audit focused on OWASP Top 10, secrets detection, and input validation.
openpencil-design
Use when designing UI with OpenPencil — creating layouts via op CLI, batch design DSL, or MCP tools. Covers PenNode schema, semantic roles, typography, color, spacing, and common component patterns.