skills: Instructions file for Codex

AGENTS.md

skills AGENTS.md is an instructions file for Codex, OpenCode from vercel-labs/skills. It costs 2,738 tokens per session, scanned A, original, MIT.

Repository instructions for the skills command-line tool, covering its purpose, structure, commands, and update system.

In plain words
What is it for?
They help with understanding the project, running its commands, working with installed skills, and checking or updating the skills tool.
Why use it?
They give a coding agent the project-specific rules it needs to make consistent changes in this codebase.

Instructions file for CodexOpenCode ✓ vendor

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md; built for openclaw.

This is vercel-labs/skills's own configuration. It tells Codex and OpenCode how to work on skills itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything skills configures →

About the project

skills is a command-line tool for discovering, installing, and using reusable instructions called skills with coding agents. It supports Codex, Claude Code, OpenCode, Cursor, and other agents, and can launch an agent with a selected skill. The catalogue entry represents an instruction and a skill for working with this ecosystem.

vercel-labs/skills · 38,275 stars · on GitHub · skills.sh

Reuse

Borrowing it

Nothing to install: this file belongs to vercel-labs/skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/vercel-labs/skills/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/vercel-labs/skills

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for skills AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/vercel-labs/skills/agents-md/github.svg)](https://agentmods.dev/instructions/vercel-labs/skills/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/vercel-labs/skills/agents-md"><img src="https://agentmods.dev/badge/instructions/vercel-labs/skills/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for skills AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/vercel-labs/skills/agents-md"><img src="https://agentmods.dev/badge/instructions/vercel-labs/skills/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 2,738 This file is loaded in full into every session.
When invoked 2,738 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.02738 $0.02738
Opus 5.5 $0.01095 $0.01095
Sonnet 5.5 $0.00548 $0.00548
Haiku 4.5 $0.00274 $0.00274

Measured today against content hash b85b2916701a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

skills AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 237 lines

How it starts

The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This file provides guidance to AI coding agents working on the skills CLI codebase.

Project Overview

skills is the CLI for the open agent skills ecosystem.

Commands

Command Description
skills Show banner with available commands
skills add <pkg> Install skills from git repos, URLs, or local paths
skills use <pkg>@<skill> Use one skill without installing
skills experimental_install Restore skills from skills-lock.json
skills experimental_sync Sync skills from node_modules into agent dirs
skills list List installed skills (alias: ls)
skills update [skills...] Update skills to latest versions
skills init [name] Create a new SKILL.md template

Aliases: skills a works for add. skills i, skills install (no args) restore from skills-lock.json. skills ls works for list. skills experimental_install restores from skills-lock.json. skills experimental_sync reads skills from npm dependencies (sync remains a compatibility alias).

Architecture

src/
├── index.ts         # Public library entry: named re-exports of src/api only
├── api/             # Programmatic API (see docs/api.md)
│   ├── types.ts     # Hand-written public types (never alias internal types)
│   ├── config.ts    # resolveConfig: call options > config > defaults; agent limits
│   ├── agents.ts    # getSupportedAgents, detectAgents
│   ├── resolve.ts   # resolveSource / SkillSource handles
│   ├── install.ts   # installSkills
│   ├── list.ts      # listSkills
│   └── remove.ts    # removeSkills
├── cli.ts           # Main entry point, command routing, init/check/update
├── cli.test.ts      # CLI tests
├── add.ts           # Core add command logic
├── add-prompt.test.ts # Add prompt behavior tests
├── add.test.ts      # Add command tests
├── concurrency.ts   # Bounded parallel map for source clones/downloads (SKILLS_CLONE_CONCURRENCY)
├── constants.ts      # Shared constants
├── diagnostics.ts   # nostics catalog of every error/warning code (SKILLS_<WHAT_WENT_WRONG>)
├── find.ts           # Find/search command
├── list.ts          # List installed skills command
├── list.test.ts     # List command tests
├── remove.ts         # Remove command implementation
├── remove.test.ts    # Remove command tests
├── agents.ts        # Agent definitions and detection
├── installer.ts     # Skill installation logic (symlink/copy) + listInstalledSkills
├── skills.ts        # Skill discovery and parsing
├── skill-lock.ts    # Global lock file management (~/.agents/.skill-lock.json)
├── local-lock.ts    # Local lock file management (skills-lock.json, checked in)
├── sync.ts          # Sync command - crawl node_modules for skills
├── source-parser.ts # Parse git URLs, GitHub shorthand, local paths
├── git.ts           # Git clone operations
├── telemetry.ts     # Anonymous usage tracking
├── types.ts         # TypeScript types
├── plugin-manifest.ts # Plugin manifest discovery support
├── prompts/         # Interactive prompt helpers
│   └── search-multiselect.ts
├── providers/       # Remote skill providers (GitHub, HuggingFace, Mintlify)
│   ├── index.ts
│   ├── registry.ts
│   ├── types.ts
│   └── wellknown.ts
├── init.test.ts     # Init command tests
├── use.ts           # Use command - generate a skill prompt or launch an agent
├── use.test.ts      # Use command tests
└── test-utils.ts    # Test utilities

tests/
├── cross-platform-paths.test.ts # Path normalization across platforms
├── full-depth-discovery.test.ts # --full-depth skill discovery tests
├── openclaw-paths.test.ts       # OpenClaw-specific path tests
├── plugin-manifest-discovery.test.ts # Plugin manifest skill discovery
├── sanitize-name.test.ts     # Tests for sanitizeName (path traversal prevention)
├── skill-matching.test.ts    # Tests for filterSkills (multi-word skill name matching)
├── source-parser.test.ts     # Tests for URL/path parsing
├── installer-symlink.test.ts # Tests for symlink installation
├── list-installed.test.ts    # Tests for listing installed skills
├── skill-path.test.ts        # Tests for skill path handling
├── wellknown-provider.test.ts # Tests for well-known provider
├── xdg-config-paths.test.ts   # XDG global path handling tests
├── api.test.ts                # Programmatic API tests
└── dist.test.ts               # Tests for built distribution

e2e/                 # Production e2e: packed tarball vs. live sources (`pnpm test:e2e`)
├── setup.ts         # globalSetup: build, `pnpm pack`, `npm install` into a clean prefix
├── env.ts           # Env allowlist (drops agent markers, XDG/config overrides, CI)
├── sandbox.ts       # Per-test HOME + project dir; runs the installed bin
├── package.e2e.ts   # Tarball contents, bin shim, runtime deps
├── api.e2e.ts       # Programmatic API from the installed package, CLI interop, shipped types
├── github.e2e.ts    # anthropics/skills, mattpocock/skills, vercel-labs/agent-skills
├── blob.e2e.ts      # skills.sh blob fast path, parity with a git clone
├── well-known.e2e.ts # https://vercel.com discovery index
├── notion.e2e.ts    # Stub `ntn` on PATH + local archive server
└── npm.e2e.ts       # experimental_sync with registry and tarball packages

__snapshots__/tsnapi/          # Public API snapshot, checked by every build

Read the full file on GitHub · 237 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +57 lines · +964 tokens per session b85b2916701a
  2. 9d ago Changed · +1 lines · +50 tokens per session be86fb68ab30
  3. 18d ago Changed · +9 lines · +129 tokens per session 47e74b5349c8
  4. 1mo ago Changed · -3 lines · -32 tokens per session 832411011f04
  5. 2mo ago First seen · 173 lines · 1,627 tokens per session scan A 2965ade05022

Subscribe to this mod's changes

skills AGENTS.md is an instructions file published in the GitHub repository vercel-labs/skills (38,275 stars, last pushed today), licensed MIT. It adds 2,738 tokens to every session, about $0.0110 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

skills AGENTS.md compared with instructions from other repositories

skills AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
skills AGENTS.mdvercel-labs/skillsInstructions file38ktodayMITA2,738Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode