Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ya5huk/findash/setupnpx skills add ya5huk/findash --skill setupgit clone --depth 1 https://github.com/ya5huk/findashWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00087 | $0.01602 |
| Opus 5 | $0.00044 | $0.00801 |
| Sonnet 5 | $0.00017 | $0.00320 |
| Haiku 4.5 | $0.00009 | $0.00160 |
Grade B, and why
setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Tell the user to create `.secrets/findash` and `chmod 600` it. Give them this single block to paste and edit — they keep only the sections they need: How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
setup
First-time onboarding for findash. You automate everything safe and local, then guide the human through everything that needs them. You never enter the user's secrets yourself and never run anything that captures their passwords through this session — you tell them exactly what to put where, and they do it. Local financial directories are mode 700 and their files mode 600; findash-doctor enforces this through scripts/harden_permissions.py.
Steps
1. Run the doctor's auto-fixes
Run the findash-doctor skill (diagnose → auto-fix → report). It creates data/ inbox/ .secrets/, fixes file modes, installs the React dashboard dependencies, and initializes the DB. It installs bank-scraper dependencies only after the user opts into a bank source. Read its report: the 🚫 Blockers and ⚠️ Optional lines are exactly the steps below that the human still has to do. See ../findash-doctor/SKILL.md.
2. Secrets — one file, filled in by the user
The examples below are deliberately unusable placeholders. Leaving a section unfinished is equivalent to omitting it: the doctor and runtime require all of that integration's values to be non-placeholder before enabling it.
Tell the user to create .secrets/findash and chmod 600 it. Give them this single block to paste and edit — they keep only the sections they need:
# .secrets/findash — chmod 600. Omit any section you don't use.
[drive]
root_folder_id=<from your vault folder's Drive URL: drive.google.com/drive/folders/<ID>>
[hapoalim]
user_code=<your hapoalim user code>
password=<your hapoalim password>
[cal]
username=<your cal username>
password=<your cal password>
[pdf-passwords]
<payslip-filename-pattern>=<password>
[ibkr]
# IBKR auth is the official Interactive Brokers connector you add in Claude (no
# password here). The account IBKR maps onto is resolved automatically by
# /findash:fetch-investments and stored in the DB — nothing to set here.
# account_name=<legacy override only — pre-existing installs>
# account_ids=<comma-separated IBKR account ids>
# base_currency=ILS
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 89 lines · 87 tokens per session scan B 19ad5a60c9b2
setup is a skill published in the GitHub repository ya5huk/findash (19 stars, last pushed 9d ago), licensed MIT. It adds 87 tokens to every session and 1,602 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
agent-host-chat-contributions
Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.