Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add WizTheAgent/IronMesh --skill ironmesh-sendgit clone --depth 1 https://github.com/WizTheAgent/IronMeshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wiztheagent/ironmesh/ironmesh-send)<a href="https://agentmods.dev/skills/wiztheagent/ironmesh/ironmesh-send"><img src="https://agentmods.dev/badge/skills/wiztheagent/ironmesh/ironmesh-send/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wiztheagent/ironmesh/ironmesh-send"><img src="https://agentmods.dev/badge/skills/wiztheagent/ironmesh/ironmesh-send.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 36 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Supply Chain · line 49 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00946 |
| Opus 5.5 | $0.00020 | $0.00378 |
| Sonnet 5.5 | $0.00010 | $0.00189 |
| Haiku 4.5 | $0.00005 | $0.00095 |
Grade A, and why
ironmesh-send scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
NODE_ID=$(curl -sS "http://127.0.0.1:${IRONMESH_GUI_PORT}/api/mesh_stats?token=${IRONMESH_GUI_TOKEN}" \ How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Send a message over IronMesh
Push a MSG frame to a named peer using the local daemon. Waits briefly for the daemon to ACK then reports the message id.
When to use
- User asks to send a message, signal, or command to another agent
- After
ironmesh-peers <target>confirms the peer is online - For ops tasks: broadcast a reload signal, kick off a remote job, etc.
When NOT to use
- If the peer is offline and the user didn't authorize queueing — ask first
- Don't send secrets via MSG unless the user knows it'll be stored
(encrypted at rest) in the peer's
messagestable
How to run
: "${IRONMESH_GUI_PORT:=8766}"
: "${IRONMESH_GUI_TOKEN:?set IRONMESH_GUI_TOKEN}"
TARGET="${1:?usage: send <peer-name-or-node-id> <payload> [priority]}"
PAYLOAD="${2:?payload required}"
PRIORITY="${3:-NORMAL}"
# Find the node_id for this agent name (if not already a node_id).
if [ ${#TARGET} -ne 32 ]; then
NODE_ID=$(curl -sS "http://127.0.0.1:${IRONMESH_GUI_PORT}/api/mesh_stats?token=${IRONMESH_GUI_TOKEN}" \
| python3 -c "
import json, sys
name = sys.argv[1]
d = json.load(sys.stdin)
for p in d['peers']:
if p['name'] == name:
print(p['node_id']); sys.exit(0)
sys.exit(1)
" -- "$TARGET")
if [ -z "$NODE_ID" ]; then
echo "ERROR: peer '$TARGET' not found in mesh_stats"
echo "Available peers:"
curl -sS "http://127.0.0.1:${IRONMESH_GUI_PORT}/api/mesh_stats?token=${IRONMESH_GUI_TOKEN}" \
| python3 -c "import json,sys; print(' '+'\\n '.join(p['name'] or p['node_id'][:16] for p in json.load(sys.stdin)['peers']))"
exit 1
fi
else
NODE_ID="$TARGET"
fi
# Use the IronMesh GUI WebSocket to submit a send (same mechanism the
# dashboard uses). We open a WS, send a single JSON command, then close.
python3 - "$NODE_ID" "$PAYLOAD" "$PRIORITY" "$IRONMESH_GUI_PORT" "$IRONMESH_GUI_TOKEN" <<'PY'
import asyncio, json, sys
node_id, payload, priority, port, token = sys.argv[1:6]
async def main():
import websockets
uri = f"ws://127.0.0.1:{port}/ws?token={token}"
async with websockets.connect(uri) as ws:
# Consume initial snapshot
await ws.recv()
await ws.send(json.dumps({
"action": "send",
"peer_id": node_id,
"type": "MSG",
"payload": payload,
"priority": priority,
}))
# Wait briefly for ACK
try:
for _ in range(5):
msg = json.loads(await asyncio.wait_for(ws.recv(), timeout=2))
if msg.get("type") == "send_ack":
print(f"ACK: msg_id={msg.get('msg_id')}")
return
if msg.get("type") == "send_error":
print(f"ERROR: {msg.get('error')}")
return 2
except asyncio.TimeoutError:
print("No ACK in 10s — queued or failed silently")
return 3
asyncio.run(main())
PY
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 102 lines · 49 tokens per session scan A 01e842a3d2ae
ironmesh-send is a skill published in the GitHub repository WizTheAgent/IronMesh (25 stars, last pushed 2d ago), licensed MIT. It adds 49 tokens to every session and 946 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
design-taste-frontend
Use for visual design direction on greenfield, user-facing surfaces — marketing and landing pages, generated apps, portfolio-style or standalone pages. NOT for routine Archestra platform UI work (dashboards, data tables, settings, forms, existing components) — use archestra-dev-frontend for that. Upstream intent…
archestra-docs-writer
Use when writing, editing, restructuring, or auditing Archestra documentation under docs/pages/ — new feature docs, page rewrites, sidebar and information-architecture changes, tone or copy fixes, diagrams, and docs screenshots.
archestra-dev-frontend
Use when modifying Archestra frontend Next.js/React code, UI components, forms, TanStack Query hooks, generated API client usage, frontend copy, or documentation links.
archestra-dev-testing
Use for test selection and quality across backend, frontend, and e2e; load its backend reference for Vitest projects, mocking, DB fixtures, and performance.
migrate-to-archestra
Migrate an existing agentic PoC/pilot (Claude Code project files, MCP configs, hooks, local tools, openclaw config, or similar hand-rolled setup artifacts) into an Archestra instance. Use when the user wants to move, port, or convert an existing agentic setup into an Archestra pilot.
managing-archestra-releases
Runs rolling beta releases, stable patches, and complete stable-line cutovers. Use when backporting fixes, cutting or retiring release branches, configuring release protections, testing artifacts, recovering failed runs, or approving releases.