A guided command for adding a third-party plugin repository to a catalog. It evaluates the source, records it in a JSON registry, and checks that a later scan finds it.

Use it to score a proposed source, register accepted sources in sources/supported-stores.json, and verify the resulting catalog entry.

It avoids manually deciding whether a source is suitable, editing the registry, and checking several related files and scripts yourself.

add-source — Command for GitHub Copilot by fabioc-aloha

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/fabioc-aloha/Alex_Skill_Mall

Made for: GitHub Copilot.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/fabioc-aloha/alex_skill_mall/add-source/github.svg)](https://agentmods.dev/commands/fabioc-aloha/alex_skill_mall/add-source)

Your own site

<a href="https://agentmods.dev/commands/fabioc-aloha/alex_skill_mall/add-source"><img src="https://agentmods.dev/badge/commands/fabioc-aloha/alex_skill_mall/add-source/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/fabioc-aloha/alex_skill_mall/add-source"><img src="https://agentmods.dev/badge/commands/fabioc-aloha/alex_skill_mall/add-source.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 25 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 646 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00025	$0.00646
Opus 5	$0.00013	$0.00323
Sonnet 5	$0.00005	$0.00129
Haiku 4.5	$0.00003	$0.00065

Measured yesterday against content hash e8cd443f6059, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

add-source scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/prompts/add-source.prompt.md · 37 lines

How it starts

The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/add-source

Add a new source store (a third-party plugin repo) to the Mall's registry. Runs the store-evaluation scorecard first; on Accept, registers in sources/supported-stores.json and verifies the next scan picks it up.

Steps

Apply store-evaluation to the proposed remote URL. Score against the five dimensions (maintenance, adoption, license, ACT fit, docs). If total < 7, decline and record rationale in the conversation.
On Accept (score ≥ 7):
- Determine name (kebab-case, ≤32 chars, matches the conventional short identifier)
- Determine pluginDir (where plugins live in the upstream repo: ., plugins, skills, agents, etc.)
- Determine quality tier: internal, official, community-curated, community, domain, or reference
- Determine provenance: false (third-party) and known license if extractable from upstream
Add the entry to sources/supported-stores.json (alphabetical by name).
Run node scripts/scan-sources.cjs locally with SOURCES_DIR pointing at a temp dir; verify the new store produces catalog/stores/<name>.json with a plausible plugin count.
Run node scripts/compute-trust.cjs and node scripts/render-catalog.cjs; confirm the new store appears in README.md ranked by trust.
Commit [behaviour] add source: <name> (<one-line rationale>).
Push and let Monday's cron produce the first full catalog refresh against the new source.

Boundaries

Do not skip the scorecard. Stores below score 7 do not get added even if the requester insists — record the decline.
Do not invent quality tier; if the upstream doesn't fit an existing tier, propose a new tier in a separate ADR-style discussion first.
Do not bypass provenance: true for any third-party store. Provenance is for first-party Mall-curated only.
Do not commit catalog regeneration in the same commit as the registry edit; let the cron own that refresh so the diff is reviewable.

Read the full file on GitHub · 37 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 37 lines · 25 tokens per session scan A e8cd443f6059

Subscribe to this mod's changes

add-source is a command published in the GitHub repository fabioc-aloha/Alex_Skill_Mall (4 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 646 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.

Project management agentic-ai ai-assistant ai-skills best-practices github-copilot knowledge-base

add-source

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

/add-source

Steps

Boundaries

What this file has done since we first saw it

Other commands, from other repositories

issue-prd-generation

artifact-insight-scan

post-pr-retrospective

checklist

clarify

specify