Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/exboys/skilllite/agents-mdgit clone --depth 1 https://github.com/EXboys/skillliteWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00633 | $0.00633 |
| Opus 5 | $0.00316 | $0.00316 |
| Sonnet 5 | $0.00127 | $0.00127 |
| Haiku 4.5 | $0.00063 | $0.00063 |
Grade B, and why
skilllite AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
`bubblewrap` must be installed for sandbox tests (`sudo apt-get install -y bubblewrap`). Without it, only `SKILLLITE_SANDBOX_LEVEL=1` (no sandbox) works. How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agents Instructions
See CLAUDE.md for project workflow, specs, and contribution guidelines.
Cursor Cloud specific instructions
Environment Overview
SkillLite is a Rust workspace (Cargo) with a Python SDK bridge. No Docker, no external databases — entirely self-contained with embedded SQLite.
Key Services
| Service | How to run | Notes |
|---|---|---|
| Rust binary (CLI) | cargo build -p skilllite then ./target/debug/skilllite |
Main dev artifact |
| Python SDK | pip install -e python-sdk |
Thin wrapper calling the Rust binary |
Running the Sandbox (Linux gotcha)
The default RLIMIT_NPROC (50) is too low in Cloud Agent VMs where ~40+ processes already run under the same UID. Set SKILLLITE_MAX_PROCESSES=200 (or higher) when running skills with sandbox level 2 or 3:
SKILLLITE_MAX_PROCESSES=200 ./target/debug/skilllite run .skills/calculator '{"operation":"add","a":1,"b":2}'
Without this, bwrap fails with "Creating new namespace failed: Resource temporarily unavailable".
Lint / Test / Build Commands
- Rust format check:
cargo fmt --check - Rust lint:
cargo clippy --all-targets -- -D warnings - Rust tests:
cargo test - Rust build:
cargo build(debug) orcargo build --release - Python lint:
ruff check python-sdk/ - Python tests:
cd python-sdk && pytest
See docs/en/CONTRIBUTING.md for full PR checklist.
Rust Toolchain
This project requires Rust 1.85+ (edition 2024 support). The update script runs rustup update stable to ensure this. If rustc --version shows < 1.85, run rustup update stable && rustup default stable.
Sandbox Binary (bwrap)
bubblewrap must be installed for sandbox tests (sudo apt-get install -y bubblewrap). Without it, only SKILLLITE_SANDBOX_LEVEL=1 (no sandbox) works.
Python venv
python3-venv (or python3.12-venv) is required for skill environment setup. Skills with dependencies create virtualenvs via python3 -m venv. Install with sudo apt-get install -y python3-venv.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 58 lines · 633 tokens per session scan B 6e3b4874a0c0
skilllite AGENTS.md is an instructions file published in the GitHub repository EXboys/skilllite (167 stars, last pushed 6d ago), licensed MIT. It adds 633 tokens to every session, about $0.0032 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
OneManCompany CLAUDE.md
Instructions for 1mancompany/OneManCompany, covering gstack and skill routing.
whoop-mcp CLAUDE.md
Instructions for shashankswe2020-ux/whoop-mcp, covering project: whoop-mcp, tech stack, commands, project structure and code conventions.
brood-box CLAUDE.md
Instructions for stacklok/brood-box, covering brood-box, commands — always use task (taskfile.yaml), architecture — strict ddd (domain-driven design), layers and ddd rules (non-negotiable).
agent-skills AGENTS.md
Instructions for magnus919/agent-skills, covering agents.md — agent guide for agent-skills, format compliance, readme format, required sections and style guidance.
wallfacer CLAUDE.md
Instructions for changkun/wallfacer: If you didn't add a test, you didn't fix a bug. Every bug fix must include a reproducible test that fails without the fix and passes with it. You commit frequently, one small scope diff at a time. Push to main once a full batch of work is complete and verified. Leftover must be…
gangsta AGENTS.md
Instructions for kucherenko/gangsta, covering contributing to gangsta, what this is, what will not be accepted, skill changes and the laws apply to contributors too.