Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yc-software/qm/deploymentnpx skills add yc-software/qm --skill deploymentgit clone --depth 1 https://github.com/yc-software/qmWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00032 | $0.00282 |
| Opus 5 | $0.00016 | $0.00141 |
| Sonnet 5 | $0.00006 | $0.00056 |
| Haiku 4.5 | $0.00003 | $0.00028 |
Grade A, and why
deploy-qm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Deploy QM
Read ../../../deployment.md completely and follow it as the authoritative
workflow. Read only the selected provider reference. Read references/email.md
before collecting secrets, because sign-in needs an email transport and one of
its steps needs the operator's DNS. Read references/slack.md only when Slack
is requested.
A deployment needs a base model key and a way for people to sign in. Collect
both in the same pass. The base model provider is a deployment choice recorded
as modelProvider, not a setting to leave for the Admin page. Sign-in is either
the built-in auth broker, which needs an email transport, or an external OIDC
provider such as Slack, which needs no email at all — read references/email.md
only once the operator has chosen the broker.
Use the repository's installed @yc-software/qm dependency through
npm exec qm -- <command>. Do not require or clone the QM source repository.
Do not stop at infrastructure health: complete the acceptance checks and return
the handoff required by deployment.md. A web response without a generated
sidebar title is not a completed deployment.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 26 lines · 32 tokens per session scan A 65074c67f268
deploy-qm is a skill published in the GitHub repository yc-software/qm (14,428 stars, last pushed today), licensed MIT. It adds 32 tokens to every session and 282 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
open-code-review
Performs AI-powered code review on Git changes using the ocr CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply…
adding-a-provider-api-feature
Add a new provider API capability (prompt caching, strict/structured tool calling, thinking/reasoning effort, service tier, safety settings, logprobs, etc.) to Pydantic AI. Use when wiring a provider feature through the library — it enforces reasoning from the existing cross-provider abstraction before designing…
agent-initialization
Initialize an Agent's settings from a user requirement by writing AGENTS.md, setting identity metadata, and installing only needed Skills.
openclaw-ci-limits
Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push single-flight, shard sizing, hosted-runner offload, queue health, and safe ramp-down/ramp-up changes. Use when tuning .github/workflows/, docs/ci.md, CI runner labels, matrix max-parallel…
release-openclaw-plugin-testing
Plan and run pre-release OpenClaw plugin validation across bundled plugins, package artifacts, lifecycle commands, doctor/fix, config round-trip, gateway startup, SDK compatibility, Docker E2E, Package Acceptance, and Testbox proof.
portfolio
Cross-chain DeFi portfolio discovery, rebalancing suggestions, and NEAR Intent construction. Activates when the user pastes a wallet address or asks about yield/positions/rebalancing. Bootstraps a per-user "portfolio" project, aggregates positions across all the user's addresses inside one project, and offers a…