Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yaniv-golan/affinity-sdk/xaffinity-cli-usagenpx skills add yaniv-golan/affinity-sdk --skill xaffinity-cli-usagegit clone --depth 1 https://github.com/yaniv-golan/affinity-sdkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yaniv-golan/affinity-sdk/xaffinity-cli-usage)<a href="https://agentmods.dev/skills/yaniv-golan/affinity-sdk/xaffinity-cli-usage"><img src="https://agentmods.dev/badge/skills/yaniv-golan/affinity-sdk/xaffinity-cli-usage.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.05807 |
| Opus 5 | $0.00015 | $0.02903 |
| Sonnet 5 | $0.00006 | $0.01161 |
| Haiku 4.5 | $0.00003 | $0.00581 |
Grade B, and why
xaffinity-cli-usage scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **`AFFINITY_API_KEY_FILE`** — write the key to a file in the project workdir (e.g., `.xaffinity-key`, gitignored, `chmod 600`) and `export AFFINITY_API_KEY_FILE=/path/to/.xaffinity-key`. Equivalent reach as `.env` but How it starts
The opening of the file, as written. The whole thing — 498 lines — stays where its author put it; the contents beside it link to each section on GitHub.
xaffinity CLI Usage
REQUIRED FIRST STEP: Verify API Key
STOP. Before doing ANYTHING else, run this command:
xaffinity config check-key --json
This MUST be your first action when handling any Affinity request.
If "configured": true - Use the pattern field from the output for ALL subsequent commands:
- If
"pattern": "xaffinity --dotenv --readonly <command> --json"-> use--dotenv - If
"pattern": "xaffinity --readonly <command> --json"-> no--dotenvneeded
If "configured": false - Stop and help user set up. The xaffinity CLI resolves the API key in this order:
AFFINITY_API_KEYenv varAFFINITY_API_KEY_FILEenv var (path to a file containing the key — Docker secrets / k8s convention)AFFINITY_API_KEY_COMMANDenv var (shell command whose stdout is the key — git-credential-helper style; works withop/pass/vault/ macOSsecurity)--api-key-file <path>or--api-key-stdinCLI flagsxaffinity config setup-keyconfig file (saved to system keychain on supported platforms)
For most users:
- Tell them: "You need to configure an Affinity API key first."
- Direct them: Affinity -> Settings -> API -> Generate New Key
- Tell them to run:
xaffinity config setup-key(do NOT run it for them - it's interactive)
For users with an existing secret manager (1Password, vault, pass, Keychain), suggest AFFINITY_API_KEY_COMMAND as a credential-helper-style integration instead.
Cowork-specific edge case: if you are running inside a Claude Cowork session and the host CLI is configured but check-key returns configured: false, the key likely lives in a host-only location (env var, ~/.config/, keychain, host-only credential helper) that the microVM does not mount. Two host-portable options:
- Project
.env+--dotenv— create a project-scope.envfile withAFFINITY_API_KEY=…. The project workdir IS mounted into the VM. This is the most common Cowork path. AFFINITY_API_KEY_FILE— write the key to a file in the project workdir (e.g.,.xaffinity-key, gitignored,chmod 600) andexport AFFINITY_API_KEY_FILE=/path/to/.xaffinity-key. Equivalent reach as.envbut works without--dotenvon the command line.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 498 lines · 30 tokens per session scan B 7a53b221be0f
xaffinity-cli-usage is a skill published in the GitHub repository yaniv-golan/affinity-sdk (0 stars, last pushed 1mo ago), licensed MIT. It adds 30 tokens to every session and 5,807 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
merit-lhv
How to pull an LHV bank statement straight into Merit Aktiva without touching a file export — LHV's own MCP server returns camt.053 XML, which is exactly what Merit's bank-statement import accepts. Covers connecting LHV (OAuth2 + Smart-ID, read-only), the 31-day window, the multi-currency trap, and where the statement…
merit-payments-bank
How to record payments and reconcile the bank statement correctly in Merit Aktiva (maksed / pank) via the elnora-merit CLI. The core skill is choosing the right transaction type for each line — customer receipt, vendor/tax payment, other income, or other expenditure — plus bank-statement import, settlements…
merit-stripe
How Stripe payments must be set up and recorded in Merit Aktiva — the canonical clearing-account method. Stripe is a payment intermediary, not your bank: never book the bank deposit as revenue (it arrives NET of fees). Each Stripe payout is booked as ONE summary GL batch — gross card sales as revenue + output VAT…
merit-tsd
The Estonian TSD (tulu- ja sotsiaalmaksu deklaratsioon) annexes that are NOT payroll: lisa 5 (gifts, donations, entertainment/vastuvõtukulud) and lisa 6 (expenses unrelated to business — fines, sunniraha, tax-authority interest). Covers what makes a TSD mandatory for a month, the 22/78 gross-up, the exact e-MTA form…
merit-vat-kmd
How VAT and the Estonian VAT return (käibedeklaratsioon / KMD) work in Merit Aktiva, and how to get them right from the elnora-merit CLI. Covers the tax-code model, paying the VAT, what feeds each KMD line, time-of-supply, and pulling supporting VAT figures. The KMD itself is generated and filed in the Merit UI — the…
merit-palk-employees
How to onboard employees and maintain contracts, contacts, and base salary agreements in Merit Palk via elnora-merit palk. Covers the sendemployees-vs-sendpayterms distinction, required import codes, and reading the employee / agreement lists. Use when: adding a new employee, creating a first contract, setting or…