Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wunki/dotfiles --skill fetch-github-filegit clone --depth 1 https://github.com/wunki/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wunki/dotfiles/fetch-github-file)<a href="https://agentmods.dev/skills/wunki/dotfiles/fetch-github-file"><img src="https://agentmods.dev/badge/skills/wunki/dotfiles/fetch-github-file/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wunki/dotfiles/fetch-github-file"><img src="https://agentmods.dev/badge/skills/wunki/dotfiles/fetch-github-file.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00199 | $0.02069 |
| Opus 5.5 | $0.00080 | $0.00828 |
| Sonnet 5.5 | $0.00040 | $0.00414 |
| Haiku 4.5 | $0.00020 | $0.00207 |
Grade A, and why
fetch-github-file scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `raw.githubusercontent.com/owner/repo/ref/path` | Raw file | Fetch via curl or gh api | How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fetch GitHub File
Fetch source code from GitHub file and directory URLs using the gh CLI for authenticated access.
Prerequisites
Verify that gh is available and authenticated before proceeding:
gh auth status
If gh is not installed or not authenticated, tell the user: "This skill requires the GitHub CLI (gh). Install it from https://cli.github.com and run gh auth login."
For GitHub Enterprise (GHE) hosts (e.g. github.mycompany.com), pass --hostname github.mycompany.com to all gh commands.
URL Patterns
Parse the GitHub URL to determine what to fetch:
| URL Pattern | Type | Action |
|---|---|---|
github.com/owner/repo/blob/ref/path |
File | Fetch file contents |
github.com/owner/repo/blob/ref/path#L10 |
File + single line | Fetch file, show line 10 with context |
github.com/owner/repo/blob/ref/path#L10-L25 |
File + range | Fetch file, show lines 10-25 |
github.com/owner/repo/tree/ref/path |
Directory | List directory contents |
github.com/owner/repo/tree/ref |
Repository root | List root directory |
github.com/owner/repo |
Repository | List root directory; offer clone for deeper exploration |
raw.githubusercontent.com/owner/repo/ref/path |
Raw file | Fetch via curl or gh api |
URL Parsing
Extract components from a GitHub URL before fetching:
https://github.com/anthropics/claude-code/blob/main/src/index.ts#L10-L25
^^^^^^^^^^^ ^^^^^^^^^^^^ ^^^^ ^^^^ ^^^^^^^^^^^^^ ^^^^^^^^
owner repo type ref path line range
type: "blob" = file, "tree" = directory
ref: branch name, tag, or full commit SHA
line range: optional; #L10 = single line, #L10-L25 = range
For raw.githubusercontent.com/owner/repo/ref/path, extract owner, repo, ref, and path directly from the path segments.
For bare github.com/owner/repo URLs with no ref, omit the ?ref= parameter entirely from API calls to use the repository's default branch.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 173 lines · 199 tokens per session scan A 60411d20119c
fetch-github-file is a skill published in the GitHub repository wunki/dotfiles (47 stars, last pushed 10d ago), licensed MIT. It adds 199 tokens to every session and 2,069 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
merge-ready
Drive an existing pull request to a mergeable state: get CI green, resolve merge conflicts with the base branch, address and resolve review comments, trigger required bot reviews/approvals (e.g. commenting '@claude review'), link associated issues, and clean up the PR title and description. Ends with a readiness…
sync-release
Owns release-pipeline conventions: sr.yaml schema, the sr CLI verbs (init/plan/prepare/ release) and urmzd/sr action, typed publishers (cargo/npm/pypi/docker/go/custom), monorepo workspace discovery, versionfiles/stagefiles mapping, and post-release patterns. Language-specific build targets live in scaffold-rust…
setup-ci
Defines GitHub Actions workflow structure: ci.yml + release.yml naming, concurrency groups, bot-commit skip, workflowcall reuse, App-token checkout, and optional fsrc/teasr steps. Language-specific pipelines live in scaffold-rust, scaffold-go, scaffold-python, scaffold-node, scaffold-terraform. Use when setting up…
pr
Open a pull request via gh pr create with an auto-generated title and summary derived from the commits on the branch, grouped by conventional-commit type. Use when the user says "create a pull request", "open a PR", "gh pr create", "raise a PR", or "make a PR for this branch". Assumes commits already exist and only…
release-audit
Audit GitHub releases, git tags, and release assets for one repo or every repo in a directory. Flags orphaned tags, missing binaries/checksums, draft releases, floating tag drift, pre-release remnants, and (when sr.yaml is present) sr config issues. Read-only: never deletes or modifies tags/releases. Use when checking…
repo-status
Scan a folder of git repos and report each repo's local dirty/clean state, ahead/behind divergence from upstream, recent activity, and latest CI run status. Read-only: never commits, pushes, or edits. Defaults to the folder argument or your repo root. Use when checking "what's live", "which repos are dirty", or "repo…