Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vlinx-io/VelaTerm --skill fix-findinggit clone --depth 1 https://github.com/vlinx-io/VelaTermWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vlinx-io/velaterm/fix-finding)<a href="https://agentmods.dev/skills/vlinx-io/velaterm/fix-finding"><img src="https://agentmods.dev/badge/skills/vlinx-io/velaterm/fix-finding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vlinx-io/velaterm/fix-finding"><img src="https://agentmods.dev/badge/skills/vlinx-io/velaterm/fix-finding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01713 |
| Opus 5.5 | $0.00017 | $0.00685 |
| Sonnet 5.5 | $0.00008 | $0.00343 |
| Haiku 4.5 | $0.00004 | $0.00171 |
Grade A, and why
fix-finding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- fix-finding — 100% identical, 4 lines differ
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fix Finding
Objective
Turn a current security finding into a minimal, validated code change. If the code is already safe, prove that and report that no change was needed.
Judge the result in this order:
- the current state is correctly classified as vulnerable, already safe, or unproven
- any fix completely closes the broken security boundary
- legitimate behavior and compatibility are preserved
- relevant repository checks pass
- the implementation follows repository conventions
- the patch contains only the scope necessary for the earlier properties
Never trade an earlier property for a later one. Minimal means the smallest repository-native change that satisfies all earlier properties, not the fewest lines.
Patch Contract
Before editing, inspect the affected implementation, its direct callers, nearby helpers, and relevant existing tests. Establish from repository evidence:
- the attacker-controlled input and concrete source-to-sink path or broken control
- the security invariant and narrowest shared enforcement boundary
- legitimate behavior, APIs, error semantics, and compatibility constraints that must remain
- the closest existing implementation, validation, and error-handling precedents
Treat the finding as a data-flow and boundary problem, not merely the named input example. Check equivalent encodings, parser forms, aliases, callers, sinks, and every representation or copy of security-sensitive state that could bypass the proposed change. Handle unsafe state explicitly; do not silently accept, truncate, or reinterpret it into another reachable form.
Pre-Patch Investigation
The parent agent owns the patch and independently traces the reported path. Before editing, launch one fresh read-only agent with fork_turns: "none" when delegation is available. If delegation is unavailable, perform the same perspective as a separate pass:
- Security-boundary and compatibility investigator: Independently trace the source-to-sink path and identify the shared enforcement boundary, affected entry points, alternate representations or lifecycle states, parser and validation-to-use transitions, concrete sibling paths, and source-backed bypass risks. Establish the legitimate workflows and public behavior that must remain, then inspect callers, implementations, optional modes, errors, side effects, repository conventions, existing helpers, and focused validation commands for integration constraints.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 97 lines · 42 tokens per session scan A 7eca2ea1175e
fix-finding is a skill published in the GitHub repository vlinx-io/VelaTerm (301 stars, last pushed 2d ago), licensed MIT. It adds 42 tokens to every session and 1,713 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.
Other skills, from other repositories
ast-grep
Use for ast-grep project setup, rule authoring, rule debugging, and structural search workflows.
wispterm-diagnostics
Use when a user wants to report, troubleshoot, or collect context for a WispTerm issue, including crashes, rendering/DPI glitches, high CPU, keyboard/input bugs, selection/copy/scrolling, SSH/SCP failures, SSH image preview failures, HTML preview/browser panel failures, SSH disconnects such as…
unifly
Inspect and manage UniFi Network infrastructure with the unifly CLI: devices, clients, VLANs, WiFi, firewall, VPN, switch ports, site settings, and cloud fleets. Use for UniFi network configuration, monitoring, and troubleshooting, not UniFi Protect camera or recording management.
ci-triage
Diagnose a failing GitHub Actions run — find the first real error in the logs, tell a flake apart from a genuine failure, and identify the commit that broke it. Use when checks are red on a PR, a workflow failed, the build is broken, CI is flaky, or the user asks why a run failed or whether a failure is real.
issue-triage
Triage a GitHub issue into something actionable — reproduce the claim, find duplicates, judge severity, and apply labels, milestone, and assignee. Use when the user asks to triage an issue, sort the backlog, deal with new issues, check whether a bug is already reported, or says "what should we do with this issue".
file-issue
Turn a rough report into a Linear issue someone can pick up — reproduce the claim, check for duplicates, and fill in team, priority, and labels. Use when the user says to file, open, or create an issue, hands over a bug report or error, or asks to get something into Linear.