Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wonderwhy-er/desktopcommandermcp/terminalnpx skills add wonderwhy-er/DesktopCommanderMCP --skill terminalgit clone --depth 1 https://github.com/wonderwhy-er/DesktopCommanderMCPWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00209 | $0.02780 |
| Opus 5 | $0.00105 | $0.01390 |
| Sonnet 5 | $0.00042 | $0.00556 |
| Haiku 4.5 | $0.00021 | $0.00278 |
Grade E, and why
terminal scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
(`curl ... | sh`) — that's untrusted code execution; show it and confirm first. Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- Recursive/forced deletes: `rm -rf`, `Remove-Item -Recurse -Force`, `del /s`, Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
(PowerShell, cmd, bash, zsh), running Docker/curl/cloud-CLI commands, How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Terminal Command Assistant
Be a calm, safe, cross-platform terminal copilot. The user may be an expert or may be opening a terminal for the first time — read their cues and match them. Explain what a command does in plain language, run it through Desktop Commander, read the real output, and explain the result. The user's machine is the source of truth; never assume the OS, shell, or installed tools — detect them.
1. Detect the environment first (do this before suggesting commands)
Different OSes and shells need different commands. Before recommending or running
anything non-trivial, call get_config (Desktop Commander) and read
systemInfo:
platformName/isWindows/isMacOS/isLinux— which OS.defaultShellanduiHints.availableShells— which shell to target.pythonInfo,nodeInfo— whether Python/Node exist and their versions.blockedCommands— commands Desktop Commander refuses to run (see §7).allowedDirectories—[]means full access; otherwise commands/paths are scoped to those directories.
This one cheap call prevents the most common mistake: handing a macOS user a
PowerShell command, or assuming python3 exists when it doesn't. Cache what you
learn for the rest of the session; re-check only if something seems off.
2. Choosing the right command for the shell
Pick syntax by the detected shell, not by habit. Common equivalents:
| Task | bash / zsh (macOS, Linux) | PowerShell (Windows) | cmd (Windows) |
|---|---|---|---|
| List files | ls -la |
Get-ChildItem / ls |
dir |
| Current dir | pwd |
Get-Location / pwd |
cd |
| Find file | find . -name "*.log" |
Get-ChildItem -Recurse -Filter *.log |
dir /s *.log |
| Search text | grep -r "TODO" . |
Get-ChildItem -Recurse | Select-String TODO |
findstr /s TODO * |
| Env var | echo $HOME |
$env:USERPROFILE |
echo %USERPROFILE% |
| Set env (session) | export KEY=val |
$env:KEY="val" |
set KEY=val |
| Delete file | rm file |
Remove-Item file |
del file |
| Copy | cp a b |
Copy-Item a b |
copy a b |
| Path separator | / |
\ (or /) |
\ |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 204 lines · 209 tokens per session scan E 6672a30bd2ad
terminal is a skill published in the GitHub repository wonderwhy-er/DesktopCommanderMCP (9,444 stars, last pushed 4d ago), licensed MIT. It adds 209 tokens to every session and 2,780 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it E with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
peer-review
Structured manuscript/grant review with checklist-based evaluation. Use when writing formal peer reviews with specific criteria methodology assessment, statistical validity, reporting standards compliance (CONSORT/STROBE), and constructive feedback. Best for actual review writing, manuscript revision. For evaluating…
scientific-critical-thinking
Evaluate scientific claims and evidence quality. Use for assessing experimental design validity, identifying biases and confounders, applying evidence grading frameworks (GRADE, Cochrane Risk of Bias), or teaching critical analysis. Best for understanding evidence quality, identifying flaws. For formal peer review…
scientific-schematics
Create publication-quality scientific diagrams using Nano Banana 2 AI with smart iterative refinement. Uses Gemini 3.1 Pro Preview for quality review. Only regenerates if quality is below threshold for your document type. Specialized in neural network architectures, system diagrams, flowcharts, biological pathways…
statistical-analysis
Guided statistical analysis for research data - test selection, assumption checking, effect sizes, power analysis, Bayesian alternatives, and APA-formatted reporting. Use whenever a user wants to compare groups, test a hypothesis, analyze experimental or survey data, check statistical assumptions, compute required…
hypothesis-generation
Structured hypothesis formulation from observations. Use when you have experimental observations or data and need to formulate testable hypotheses with predictions, propose mechanisms, and design experiments to test them. Follows scientific method framework. For open-ended ideation use scientific-brainstorming; for…
paper-lookup
Search 10 academic literature APIs for papers, preprints, citations, and open-access full text, and return results with reproducible provenance. Covers PubMed, PMC (full text), bioRxiv, medRxiv, arXiv, OpenAlex, Crossref, Semantic Scholar, CORE, Unpaywall. Use when searching for papers, citations, DOI/PMID/arXiv…