Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/pleaseai/claude-code-plugins/add-vendorgit clone --depth 1 https://github.com/pleaseai/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.01836 |
| Opus 5 | $0.00020 | $0.00918 |
| Sonnet 5 | $0.00008 | $0.00367 |
| Haiku 4.5 | $0.00004 | $0.00184 |
Grade A, and why
add-vendor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 229 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add a new Type 2 vendor to the marketplace.
Arguments: $ARGUMENTS (format: <vendor-name> <github-repo-url>)
Example: /add-vendor mastra https://github.com/mastra-ai/skills
Step 1 — Parse & Validate Input
Parse $ARGUMENTS to extract:
VENDOR_NAME: first token (e.g.oxc)REPO_URL: second token (e.g.https://github.com/nicolo-ribaudo/oxc)
Validate:
- Both tokens are present. If not, stop and show:
Usage: /add-vendor <name> <github-repo-url> REPO_URLmatches patternhttps://github.com/<owner>/<repo>(or[email protected]:<owner>/<repo>). Normalize to HTTPS form.VENDOR_NAMEcontains only alphanumeric characters, hyphens, and underscores.
Check scripts/meta.ts — read the file and verify VENDOR_NAME is NOT already a key in the vendors object. If it already exists, stop and report: Vendor '<name>' already exists in scripts/meta.ts.
Step 2 — Explore Vendor Repository
Use the GitHub MCP tool or gh CLI to browse the vendor repository and find its skills/ directory:
gh api repos/<owner>/<repo>/contents/skills
- If the API returns a 404 or the directory doesn't exist, stop and report:
No skills/ directory found in <REPO_URL>. This repository is not a Type 2 vendor (it doesn't self-host skills). Consider using /generate-skill for Type 1 skill generation from docs. - If the directory exists, list all subdirectory names under
skills/— these are the available source skills.
Display the found skills to the user:
Found skills in <REPO_URL>/skills/:
- <skill-1>
- <skill-2>
...
Step 3 — Determine Skill → Plugin Mappings
For each skill found, determine:
- Output skill name — usually the same as the source skill name (identity mapping). Ask the user if they want to rename any skill.
- Target plugin — which
plugins/<plugin>/directory the skill should go into.
Read scripts/cli.ts to see existing SKILL_TO_PLUGIN entries and existing plugins in plugins/.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 229 lines · 0 tokens per session scan A 1f08251d85d5
add-vendor is a command published in the GitHub repository pleaseai/claude-code-plugins (13 stars, last pushed 7d ago), licensed MIT. It adds 41 tokens to every session and 1,836 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
add-portal
You are helping the user build a job-portal search skill for a job board in their market. The repo ships worked examples of the pattern (four Danish portals plus the country-agnostic linkedin-search and freehire-search), and the README invites users elsewhere to build equivalents — this command turns that invitation…
send
Send a message to a running agent session. Use this to correct or direct a live agent mid-stream without killing and respawning it.
execute
Delegate execution to GJC (runs /skill:ultragoal to completion with verification).
vibe-agents
Step 4 of the vibe-coding workflow: generate AGENTS.md + tool configs so the AI builder stays on track.
agentlas-cloud
Staff a task only from the signed-in owner's Agent Cloud agents.
advisor
Advisory gate for triage or plan decisions. Spawns a second-opinion agent that challenges assumptions, surfaces risks, and proposes alternatives before the decision commits. Based on Anthropic advisor tool pattern.