Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add XAIHT/Tlamatini --skill tlamatini_allowed_hosts_tightengit clone --depth 1 https://github.com/XAIHT/TlamatiniWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xaiht/tlamatini/tlamatini_allowed_hosts_tighten)<a href="https://agentmods.dev/skills/xaiht/tlamatini/tlamatini_allowed_hosts_tighten"><img src="https://agentmods.dev/badge/skills/xaiht/tlamatini/tlamatini_allowed_hosts_tighten/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xaiht/tlamatini/tlamatini_allowed_hosts_tighten"><img src="https://agentmods.dev/badge/skills/xaiht/tlamatini/tlamatini_allowed_hosts_tighten.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00570 |
| Opus 5 | $0.00018 | $0.00285 |
| Sonnet 5 | $0.00007 | $0.00114 |
| Haiku 4.5 | $0.00004 | $0.00057 |
Grade A, and why
tlamatini-allowed-hosts-tighten scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Tighten ALLOWED_HOSTS
The Tlamatini security report flagged the default ALLOWED_HOSTS=['*']
in Tlamatini/tlamatini/settings.py as one of the Tlamatini-specific
debts. This skill replaces it with a user-supplied whitelist and writes
a .bak backup next to the file.
Procedure
- Read
Tlamatini/tlamatini/settings.py. - Locate the line
ALLOWED_HOSTS = [...](any list literal). - Backup the current file as
settings.py.bak. - Rewrite
ALLOWED_HOSTSwith${input.hosts}rendered as a Python list. - Return
{settings_path, backup_path, changed}.
Rollback
If the new list is incorrect, restore settings.py.bak over settings.py
manually.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 60 lines · 36 tokens per session scan A 5ff6c4aa77f4
tlamatini-allowed-hosts-tighten is a skill published in the GitHub repository XAIHT/Tlamatini (16 stars, last pushed today), licensed MIT. It adds 36 tokens to every session and 570 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agentfield
Design and ship a multi-agent system on AgentField. Use when the user asks to build, scaffold, design, or run an agent, reasoner network, multi-agent backend, or 'an agent that does X' — whenever the work would otherwise be a single LLM call or a flat LangChain/CrewAI/AutoGen chain. The skill produces composite…
bfl-api
BFL FLUX API integration guide covering endpoints, async polling patterns, rate limiting, error handling, webhooks, and regional endpoints with Python and TypeScript code examples.
github-oauth-nango-integration
Use when implementing GitHub OAuth + GitHub App authentication with Nango - provides two-connection pattern for user login and repo access with webhook handling.
vllm
Deploy and serve LLMs with vLLM behind an OpenAI-compatible endpoint, with tool calling enabled for agent workloads.
data-fetching
Use when implementing or debugging ANY network request, API call, or data fetching. Covers fetch API, axios, React Query, SWR, error handling, caching strategies, offline support.
django
Use when building, reviewing, securing, testing or shipping a Django app — models, migrations, QuerySets/managers, FBV/CBV views, forms, the admin, settings split, and Django REST Framework (serializers, ModelViewSet, permissions). NOT async FastAPI/Pydantic services (that is fastapi), NOT Postgres schema/index work…