Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/soia-team/soia-open-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/soia-team/soia-open-skills/marketplace)<a href="https://agentmods.dev/plugins/soia-team/soia-open-skills/marketplace"><img src="https://agentmods.dev/badge/plugins/soia-team/soia-open-skills/marketplace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/soia-team/soia-open-skills/marketplace"><img src="https://agentmods.dev/badge/plugins/soia-team/soia-open-skills/marketplace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
soia marketplace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "soia",
"owner": {
"name": "soia-team"
},
"description": "SOIA Skills 双格式插件市场，按领域分发可复用 AI 工作流。",
"plugins": [
{
"name": "soia-dev",
"description": "工程与 UI 技能：功能规格、架构、实现审查、UI 设计验收与按需工具",
"source": {
"source": "github",
"repo": "soia-team/soia-open-dev-skills",
"sha": "0cb0dbc4fdf5a4b11b2f0e025cc16b821acf3df3"
}
},
{
"name": "soia-cwork-office",
"description": "办公协作技能：飞书知识库与云盘、ProcessOn 图表",
"source": {
"source": "github",
"repo": "soia-team/soia-open-cwork-office-skills",
"sha": "4cfaed78d8740e36aa0ba8605d2440a04d965d21"
}
},
{
"name": "soia-pkm-vault",
"description": "知识库技能：初始化、整理、提炼、翻译、转换与书库",
"source": {
"source": "github",
"repo": "soia-team/soia-open-pkm-vault-skills",
"sha": "4caad22d2dfc0fc407d9714c4e72c4210a31b25d"
}
},
{
"name": "soia-media-content",
"description": "新媒体内容技能：文章成文、文章图片与公众号、X、小红书发布",
"source": {
"source": "github",
"repo": "soia-team/soia-open-media-content-skills",
"sha": "cc6495a136a88effbd7c4241c97339a114f9afe6"
}
},
{
"name": "soia-edu-course",
"description": "教育课程技能：课程大纲设计与教案编写",
"source": {
"source": "github",
"repo": "soia-team/soia-open-edu-course-skills",
"sha": "8543e58b4f1d6f4ac3474815600baa369cd63395"
}
},
{
"name": "soia-env",
"description": "环境技能：AI CLI 与运行时安装、网络诊断、系统维护",
"source": {
"source": "github",
"repo": "soia-team/soia-open-env-skills",
"sha": "dad187beaeceb14bac7758d5e0e1b3c95b1feca8"
}
},
{
"name": "soia-meta",
"description": "SOIA 技能生态门户：规范真源、技能目录与跨仓路由清单",
"source": "./"
}
]
}
The plugins it lists here
This marketplace lists 1 plugin kept in the same repository. Each has its own page, its own measurements and its own install command.
What ships with it
1 file beside marketplace.json in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -9 lines 8c0e414e902a
- 2d ago Changed 598ea63b5c4e
- 4d ago Changed 510d838dff06
- 6d ago Changed b22c37eef511
- 10d ago First seen · 78 lines scan A e8ce112edd4e
soia marketplace is a plugin published in the GitHub repository soia-team/soia-open-skills (5 stars, last pushed yesterday), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
okf
Open Knowledge Format for Claude: the OKF skill, /okf:gem setup and doctor, and a post-edit hook that runs the okf CLI's validate and lint checks on the bundle you touched.
memex
Zettelkasten-based agent memory system with bidirectional links.
prd-os
PRD operating system: capture rough ideas, draft reviewable PRDs, run standard and adversarial review (Codex or a Claude senior-staff-engineer subagent, recorded truthfully), triage findings, decompose approved PRDs into atomic issue specs, and execute those issues with scope enforcement, stop-gate receipts, and…
scraps-migration
LLM migration workflows for moving Scraps wikis from v0 to v1. Runs version-pinned audits, converts tag and config syntax, and verifies the result with v1 lint/build.
hipocampus
Persistent agent memory that survives across sessions — auto-compacting 3-tier memory with hybrid search. Your agent remembers what it learned, decided, and built.
claude-code-engineering
Turn Claude Code into a team that has to prove it: 44 skills, 8 review agents, a validation router, and a knowledge layer where nothing is asserted without a check that could have failed.