Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/rolecraft-sh/rolecraft/registrygit clone --depth 1 https://github.com/rolecraft-sh/rolecraftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/rolecraft-sh/rolecraft/registry)<a href="https://agentmods.dev/commands/rolecraft-sh/rolecraft/registry"><img src="https://agentmods.dev/badge/commands/rolecraft-sh/rolecraft/registry.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01347 |
| Opus 5 | $0.00000 | $0.00674 |
| Sonnet 5 | $0.00000 | $0.00269 |
| Haiku 4.5 | $0.00000 | $0.00135 |
Grade A, and why
registry scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
rolecraft Registry
The rolecraft Registry is a centralised skill index powered by GitHub. Skills are published via PRs, automatically validated, then merged by a maintainer.
Registry repo: https://github.com/rolecraft-sh/registry
Usage overview
| Command | What it does |
|---|---|
rolecraft search <query> --registry |
Search the registry |
rolecraft install <slug> |
Install a skill by its registry slug |
rolecraft publish <source> |
Publish your skill to the registry |
rolecraft check |
Updates include registry version checks |
Search the registry
rolecraft search code-review --registry
Sample output:
📦 Registry results for "code-review":
SLUG DESCRIPTION VERSION STARS INSTALLS
code-review Best practices for code review v1.0.0 482 1520
1 result(s) found.
The --registry flag filters the registry index by slug, name, or description.
Install by slug
# Instead of: rolecraft install user/full-repo-name
rolecraft install my-skill
When you pass a slug that isn't a local path, GitHub ref, git URL, or npm ref, rolecraft automatically looks it up in the registry and resolves it to the underlying GitHub repo.
This works through the existing install flow, so all flags like --yes, --global, --dry-run, --frozen-lockfile, and --symlink continue to work.
Publish a skill
Using CLI (recommended)
You need your own GitHub token (scope: repo) to publish. See publish.md for full details.
Quick start:
# 1. Create a token at: https://github.com/settings/tokens
export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxx
# 2. Publish your skill
rolecraft publish ./my-skill/ --repo user/my-skill --yes
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 148 lines · 0 tokens per session scan A 133ef0d4fd49
registry is a command published in the GitHub repository rolecraft-sh/rolecraft (75 stars, last pushed 7d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,347 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
audit-artifacts
List suspicious root agent process files and placement directories.
uninstall
Uninstall filetree from this repo — un-wires CLAUDE.md/AGENTS.md, removes generated artifacts (confirmed per item), tears down self-only mode if enabled.
audit
Diff live infrastructure against the spec and report drift by component name.
research-component
Research and add a new infra component from a documentation link the user provides — crawl the docs, fan out subagents over the relevant subpages, then write, register, and validate the component.
print-form
Command "print-form" from Ganbin/4d-development-skill, covering description, example 1, example 2, example 3 and see also.
vp-run-offscreen-area
VP Run offscreen area ( parameters : Object) : Mixed.