Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/soia-team/soia-open-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/soia-team/soia-open-skills/marketplace)<a href="https://agentmods.dev/plugins/soia-team/soia-open-skills/marketplace"><img src="https://agentmods.dev/badge/plugins/soia-team/soia-open-skills/marketplace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/soia-team/soia-open-skills/marketplace"><img src="https://agentmods.dev/badge/plugins/soia-team/soia-open-skills/marketplace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
soia marketplace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "soia",
"owner": {
"name": "soia-team"
},
"description": "SOIA Skills 双格式插件市场，按领域分发可复用 AI 工作流。",
"plugins": [
{
"name": "soia-dev",
"description": "工程与 UI 技能：功能规格、架构、实现审查、UI 设计验收与按需工具",
"source": {
"source": "github",
"repo": "soia-team/soia-open-dev-skills",
"sha": "aad13a4608750eb05dd33c264d36514443a5fe2d"
}
},
{
"name": "soia-cwork-office",
"description": "办公协作技能：飞书知识库与云盘、ProcessOn 图表",
"source": {
"source": "github",
"repo": "soia-team/soia-open-cwork-office-skills",
"sha": "a3ef2273774d57fb9516eeb073385d9f759612d3"
}
},
{
"name": "soia-pkm-vault",
"description": "知识库技能：初始化、整理、提炼、翻译、转换与书库",
"source": {
"source": "github",
"repo": "soia-team/soia-open-pkm-vault-skills",
"sha": "c41d641ed66c5d9d196ee62b1a1a0303e7d3c28b"
}
},
{
"name": "soia-media-content",
"description": "新媒体内容技能：文章成文、文章图片与公众号、X、小红书发布",
"source": {
"source": "github",
"repo": "soia-team/soia-open-media-content-skills",
"sha": "3e92a606ba813af387caf1fa0f443ae330f07eb3"
}
},
{
"name": "soia-edu-course",
"description": "教育课程技能：课程大纲设计与教案编写",
"source": {
"source": "github",
"repo": "soia-team/soia-open-edu-course-skills",
"sha": "1736e89d7f63e010a697222b866c14781257e6a1"
}
},
{
"name": "soia-env",
"description": "环境技能：AI CLI 与运行时安装、网络诊断、系统维护",
"source": {
"source": "github",
"repo": "soia-team/soia-open-env-skills",
"sha": "77b67871d4191fde4425c372200dfadbd409fe5e"
}
},
{
"name": "soia-meta",
"description": "SOIA 技能生态门户：规范真源、技能目录与跨仓路由清单",
"source": "./"
}
]
}
The plugins it lists here
This marketplace lists 1 plugin kept in the same repository. Each has its own page, its own measurements and its own install command.
What ships with it
1 file beside marketplace.json in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago Changed 4d74e6e8060c
- 29d ago Changed d68ebeb10665
- 1mo ago Changed 8a7f0ab9946b
- 1mo ago Changed a84a28e18927
- 1mo ago Changed 8470e6c7255c
- 1mo ago Changed 8e1f93519934
- 1mo ago Changed 7d1d6df61eed
- 1mo ago Changed · -9 lines 8c0e414e902a
- 1mo ago Changed 598ea63b5c4e
- 1mo ago First seen · 78 lines scan A 510d838dff06
soia marketplace is a plugin published in the GitHub repository soia-team/soia-open-skills (5 stars, last pushed yesterday), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
prd-os
PRD operating system: capture rough ideas, draft reviewable PRDs, run standard and adversarial review (Codex or a Claude senior-staff-engineer subagent, recorded truthfully), triage findings, decompose approved PRDs into atomic issue specs, and execute those issues with scope enforcement, stop-gate receipts, and…
okf
Open Knowledge Format for Claude: the OKF skill, /okf:gem setup and doctor, and a post-edit hook that runs the okf CLI's validate and lint checks on the bundle you touched.
memex
Zettelkasten-based agent memory system with bidirectional links.
chamber
Checks that the numbers, capitalised names, and file names in a claim occur in the indexed note. Local, no model. It does not judge meaning.
hipocampus
Persistent agent memory that survives across sessions — auto-compacting 3-tier memory with hybrid search. Your agent remembers what it learned, decided, and built.
youtube-knowledge
Search YouTube, read timestamped transcripts, comments and metadata, cut clips, and keep a searchable local library and per channel brains. Runs locally; needs yt-dlp.