Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wardawgmalvicious/agent-config --skill landgit clone --depth 1 https://github.com/wardawgmalvicious/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wardawgmalvicious/agent-config/land)<a href="https://agentmods.dev/skills/wardawgmalvicious/agent-config/land"><img src="https://agentmods.dev/badge/skills/wardawgmalvicious/agent-config/land/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wardawgmalvicious/agent-config/land"><img src="https://agentmods.dev/badge/skills/wardawgmalvicious/agent-config/land.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00214 | $0.02537 |
| Opus 5 | $0.00107 | $0.01269 |
| Sonnet 5 | $0.00043 | $0.00507 |
| Haiku 4.5 | $0.00021 | $0.00254 |
Grade B, and why
land scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
`github-mcp` is project scope (`.mcp.json`), bound to one token, and How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Landing a branch
Take a branch that is already committed and get it merged. commit
ends by reporting hashes "against a clean tree" with an explicit note
that nothing was pushed; this starts exactly there.
Two things here are irreversible or outward-facing — opening the PR and
pushing main — so the procedure gates each one.
1. Preflight
git status --short # must be clean
git branch --show-current # must not be main
git log --oneline origin/main..HEAD
A dirty tree means commit has not finished. Nothing to land means
there is nothing to do — say so rather than opening an empty PR.
Ask whether another session is live in this working tree. Step 7
runs git switch, and one working tree has one HEAD, so the switch is
not scoped to you — it moves the branch under anyone else working here.
If someone is, stop after step 6 and let them finish.
2. Establish the identity before anything outward
This gates every outward action, and it is the step most likely to fail silently.
git config user.name # the includeIf identity for this root
gh api user -q .login # the account gh will actually act as
git remote -v # who owns the repo
Then github-mcp → get_me when that server is loaded, and compare
every login against the repo owner. Use the tool whose account matches.
On this machine gh is folder-scoped (since 2026-09-04): both
shell profiles wrap it to act as the account named by the repo's
user.name, resolved per call through a scoped GH_TOKEN, so a
personal repo gets the personal account and a client root gets the
client one. Two consequences. gh auth status reports the keyring's
active account, not the one the wrapper will use — gh api user is
the honest probe. And the wrapper is a profile function, so a gh run
from a script or hook that skips the profile falls back to the active
account; probe through the same shell the PR command will use.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed 09fa8ebf5204
- 3d ago Changed · +2 lines d39da9f80b12
- 7d ago Changed · +19 lines · +19 tokens per session scan A → B 6fbf8aa9f366
- 8d ago First seen · 198 lines · 195 tokens per session scan A 3159b818669b
land is a skill published in the GitHub repository wardawgmalvicious/agent-config (1 stars, last pushed yesterday), licensed MIT. It adds 214 tokens to every session and 2,537 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
github-operations
WORKFLOW SKILL — Full GitHub contribution lifecycle: branches, conventional commits, issues, PRs, Actions, releases. gh CLI-first with MCP fallback. WHEN: "commit", "push", "open PR", "create branch", "create issue", "cut release", "GitHub operation". DO NOT USE FOR: Azure infrastructure, Bicep/Terraform code…
azure-deploy
WORKFLOW SKILL — Execute Azure deployments (azd up, azd deploy, terraform apply) for already-prepared apps with built-in error recovery. WHEN: 'run azd up', 'run azd deploy', 'push to production', 'go live', 'bicep deploy', 'terraform apply', 'publish to Azure'. DO NOT USE FOR: creating new apps (azure-prepare)…
aws-ci-cd-release-engineer
Review AWS CI/CD and release safety across CodePipeline, CodeBuild, CodeDeploy, GitHub Actions, GitLab, artifact provenance, deployment gates, approvals, tests, progressive delivery, rollback, change correlation, and incident-prevention recommendations. Use when AWS releases or pipelines can affect production…
shipping-and-launch
Pre-deploy hygiene for a Spring Boot 4 feature — verify gates, capture rollback plan, sign off observability, generate release notes, and stage the rollout. Used by /ship after /review approves the diff. The agent never deploys; it produces the plan a human executes.
github-release-management
Comprehensive GitHub release orchestration with AI swarm coordination for automated versioning, testing, deployment, and rollback management.
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.