Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add adaptocms/adapto-cms-agent-skills --skill adapto-installgit clone --depth 1 https://github.com/adaptocms/adapto-cms-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adaptocms/adapto-cms-agent-skills/adapto-install)<a href="https://agentmods.dev/skills/adaptocms/adapto-cms-agent-skills/adapto-install"><img src="https://agentmods.dev/badge/skills/adaptocms/adapto-cms-agent-skills/adapto-install/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adaptocms/adapto-cms-agent-skills/adapto-install"><img src="https://agentmods.dev/badge/skills/adaptocms/adapto-cms-agent-skills/adapto-install.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02620 |
| Opus 5 | $0.00032 | $0.01310 |
| Sonnet 5 | $0.00013 | $0.00524 |
| Haiku 4.5 | $0.00006 | $0.00262 |
Grade D, and why
adapto-install scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **`install.sh` needs sudo / permission denied** → surface the prompt; the user types their password. Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
> `curl -sSL https://raw.githubusercontent.com/adaptocms/adapto-cms-cli/main/scripts/install.sh | bash` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- A shell, network, and `curl` or `wget`. Node 20+ for the `create-adapto-app` path. How it starts
The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.
adapto:install
The global bootstrap — like npm create. It makes the toolchain ready, then hands off to the right
setup skill. It writes no CMS content (mutates: false), but it does perform host-level changes
(installing/upgrading the CLI), which are gated by explicit consent.
When to use
- First-time setup / the front door: "set up adapto", "get started", "adapto init". It preflights
(
adapto:doctor), ensures the CLI, then routes toadapto:scaffold. (No separateadapto:init— this is it.) - The
adaptoCLI is missing or out of date (e.g.adapto:doctorflagged it). - Starting a new Adapto project.
When not to use
- Routine content/schema/translation work → the specific skill.
- Only checking whether things are OK →
adapto:doctor(read-only; it never installs anything).
Inputs
- New project vs existing repo (auto-detect from cwd; confirm with the user).
- New projects: framework (
next|astro|sveltekit) and, optionally, a public API key. - Optional: a specific CLI version to install (defaults to the supported baseline,
>=0.1.3).
Outputs
adaptoCLI installed and at/above the baseline, verified viaadapto version.- The user routed to
adapto:scaffoldto create a new project. - (v1, spec-level) per-repo skill pack installed under
.claude/skills/+.adapto/skills.lockpins.
Preconditions
- A shell, network, and
curlorwget. Node 20+ for thecreate-adapto-apppath. - Does NOT require the CLI — installing/upgrading it is this skill's job (same self-bootstrapping
exception as
adapto:doctornot requiring auth). Therequires.clirange above is the target it ensures, not a gate that blocks the skill from running.
Flow
A. Ensure the CLI — consent-gated
- Check: run
adapto version. Three cases:- Missing (
adaptonot found on PATH) → propose install. - Below baseline (
< 0.1.3) → propose upgrade. - At/above baseline → skip to (B).
- Missing (
- Inform + show the exact command + get explicit consent before running anything, e.g.:
"Your Adapto CLI is
<missing | vX, below the supported v0.1.3>. I'd like to install it by running:curl -sSL https://raw.githubusercontent.com/adaptocms/adapto-cms-cli/main/scripts/install.sh | bashThis downloads the latest release binary to/usr/local/bin/adaptoand may prompt for your password. Run it?" - On consent: run the command, then re-verify with
adapto versionand report the new version. If declined: stop, and print the command so the user can run it themselves.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 167 lines · 65 tokens per session scan D 707cd3731571
adapto-install is a skill published in the GitHub repository adaptocms/adapto-cms-agent-skills (1 stars, last pushed 1mo ago), licensed MIT. It adds 65 tokens to every session and 2,620 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
invest
First-time fork users: run the invest-setup skill first to initialize. The main flow lives in this skill (the AI agent uses the CLI/MCP to view the portfolio / run the committee / replay decision history). The Web GUI has been retired (2026-07) — every capability is exposed via CLI subcommands / MCP tools. The backend…
invest-setup
A first-time setup workflow for openInvest, a system for tracking investments and running portfolio analysis.
invest-backup
Back up / restore openInvest's local state — memory/ (holdings, strategy, user profile, committee records, dream logs) + db/ (trade ledger, job run history, market-data cache) + .env (SMTP/API credentials) + userprofile.json. All of this data is .gitignore'd with no historical versions in git, so a single accidental…
okf-frontmatter
Maintain openInvest's docs (docs/wiki chapters + docs/wiki/adr) under Google's Open Knowledge Format (OKF). Two jobs. (1) Teach agents to maintain docs the OKF way — every doc carries a small YAML frontmatter block as the single source of truth (type, title, tags, intent, schemasource, documents); schema details link…
yield-xyz-agentkit-builder
Build applications that integrate with the Yield.xyz APIs — staking, lending, vaults, and RWA across 80+ networks. Generates code covering REST API integration, transaction signing, wallet connection, and fee monetization. Use when user wants to build an app, integrate yield, generate code, or set up a project using…
yield-xyz-agentkit-privy
The Privy connector for the Yield.xyz AgentKit — signs and broadcasts via Privy agentic wallets. Extends the yield-xyz-agentkit skill — that skill discovers yields and builds the unsigned transactions; this one adds Privy wallet creation, policy enforcement, signing, and broadcasting, in autonomous and semi-autonomous…