Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinta/hal-9000 --skill update-playbooksgit clone --depth 1 https://github.com/vinta/hal-9000Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinta/hal-9000/update-playbooks)<a href="https://agentmods.dev/skills/vinta/hal-9000/update-playbooks"><img src="https://agentmods.dev/badge/skills/vinta/hal-9000/update-playbooks.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 5 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01285 |
| Opus 5 | $0.00028 | $0.00642 |
| Sonnet 5 | $0.00011 | $0.00257 |
| Haiku 4.5 | $0.00006 | $0.00128 |
Grade A, and why
update-playbooks scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Bash(curl:*) How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update Playbooks
Close the drift between each install task in playbooks/roles/*/tasks/main.yml and the upstream docs it cites, then commit per tool.
Drift takes three forms, and all three are read off the same page — the # comment URL above the task:
- Version drift — the pin trails the newest release of its release line.
- Method drift — upstream now recommends a different way to install.
- Link drift — the doc URL itself moved.
A release line is the version prefix a project treats as a stable series: Node 24.x, Python 3.14.x, kubectl 1.35.x. Every bump stays inside the line (24.15.0 -> 24.18.0 is in-line for Node because Node's line is the major). When a newer line exists (Node 26, Python 3.15, kubectl 1.36), keep the pin on its current line and report the newer line in the final summary so the user can decide.
One pin lives outside the roles and answers to a different source of truth — playbooks/collections/requirements.yml, covered in §4.
1. Scan
grep -rn -E '^# https?://|^- name:' playbooks/roles/*/tasks/main.yml
Adjacent line numbers pair each URL with the task it documents. Done when every install task is listed with its role, its doc URL, and any version pinned in its name, command body, or download URL.
2. Read the upstream docs
Fetch each doc URL once and take all three answers off that one page:
- newest tag inside the release line —
gh api repos/OWNER/REPO/releases --jq '.[].tag_name'for agithub.com/OWNER/REPOlink, WebFetch otherwise - the install commands the page currently recommends for macOS — quote them verbatim, including which method the page calls recommended when it ranks them
- where the URL lands —
curl -sIL -o /dev/null -w '%{http_code} %{url_effective}\n' URL
Done when every task has today's version, install commands, and final URL confirmed from its page. Anything recalled from training data is stale by definition.
3. Edit
Apply the drift found, matching the surrounding task style:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 81 lines · 56 tokens per session scan A eb0ab787a513
update-playbooks is a skill published in the GitHub repository vinta/hal-9000 (128 stars, last pushed today), licensed MIT. It adds 56 tokens to every session and 1,285 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tiny-web-crawler
Crawl from one or more starting web pages, fetch readable content, search within pages, follow relevant links, and stop when the requested information is found or a bounded limit is reached.
live-tutorial
Create an annotated MP4 tutorial from a workflow demonstrated in the owner's actual application. Use when asked for a tutorial video, not merely to watch an action live.
query-snmp-traps
Query SNMP trap logs through Netdata Cloud or directly from a Netdata Agent. Use when the user asks about SNMP traps, trap journal entries, trap severities, trap categories, trap senders, deduplication summaries, decode errors, TRAP fields, TRAPVAR indexed varbind fields, TRAPJSON varbind audit data, or how to inspect…
background-task
Add or modify work that runs outside the request/response cycle — emails, document ingestion, webhooks, cleanups, scheduled jobs. Use when something is slow or fire-and-forget, or when adding a periodic/cron task. This project's queue is {{ cookiecutter.backgroundtasks }}.
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…
alembic-migration
Create, review, and apply database schema changes with Alembic. Use whenever a SQLAlchemy model is added or changed, a column/index/constraint needs to change, or a data backfill is required — anything that alters the PostgreSQL schema.