Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aeonfun/aeon --skill weekly-aeoncardgit clone --depth 1 https://github.com/aeonfun/aeonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeonfun/aeon/weekly-aeoncard)<a href="https://agentmods.dev/skills/aeonfun/aeon/weekly-aeoncard"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/weekly-aeoncard.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 105 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.02042 |
| Opus 5 | $0.00019 | $0.01021 |
| Sonnet 5 | $0.00008 | $0.00408 |
| Haiku 4.5 | $0.00004 | $0.00204 |
Grade A, and why
weekly-aeoncard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- weekly-aeoncard — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
${var} — window + delivery control.
- empty → weekly card: last 7 days + all-time, render the image, notify.
dry-run→ render the image + report + dashboard spec but send no notification (artifacts still write). Combine with a window, e.g.dry-run 30.- integer
N→ override the weekly window to the lastNdays (default 7, cap 90). Example:14,30.
Today is ${today}. Turn this instance's own token ledger (memory/token-usage.csv) into a one-glance recap: how many tokens it burned this week, how many since it started, which skills dominate — rendered as a self-contained SVG card an operator can screenshot and share. Every number is measured from the ledger; nothing is fetched, sampled, or estimated. The heavy lifting is in skills/weekly-aeoncard/render_card.py (pure Python stdlib, deterministic) so you orchestrate, not hand-compute.
Steps
-
Parse
${var}→ window + mode.V="$(echo "${var}" | tr '[:upper:]' '[:lower:]' | xargs)" MODE=execute; case "$V" in dry-run*) MODE=dry-run; V="${V#dry-run}"; V="$(echo "$V" | xargs)";; esac WINDOW_DAYS=7; case "$V" in ''|*[!0-9]*) : ;; *) WINDOW_DAYS="$V";; esac [ "$WINDOW_DAYS" -gt 90 ] 2>/dev/null && WINDOW_DAYS=90 [ "$WINDOW_DAYS" -lt 1 ] 2>/dev/null && WINDOW_DAYS=7 -
Guard the ledger. The recap is synthesis-only — no ledger, nothing to show.
CSV=memory/token-usage.csv if [ ! -s "$CSV" ] || [ "$(wc -l < "$CSV")" -lt 2 ]; then ./notify "weekly-aeoncard skipped: memory/token-usage.csv absent or empty (no runs recorded yet)" exit 0 # WEEKLY_AEONCARD_NO_DATA fi -
Derive the instance name + image link. From the git origin, so the card self-labels and the notification deep-links the committed SVG.
REMOTE="$(git remote get-url origin 2>/dev/null)" REPO="$(echo "$REMOTE" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?/?$#\1#')" INSTANCE="${REPO#*/}"; [ -n "$INSTANCE" ] || INSTANCE=aeon SVG="output/images/weekly-aeoncard-${today}.svg" IMG_LINK="https://github.com/${REPO}/blob/main/${SVG}" -
Render the card + artifacts. One call writes the SVG (canonical image), a best-effort PNG, the markdown report, the dashboard spec, and appends the run log. It prints a one-line JSON summary on stdout — capture it.
mkdir -p output/images output/articles apps/dashboard/outputs # The PNG (for inline Telegram) needs a rasterizer. The workflow stages `rsvg-convert` # (librsvg2-bin) for this skill before the run — the agent allowlist blocks in-run # pip/apt. render_card.py uses cairosvg if importable, else rsvg-convert, else SVG-only. SUMMARY="$(python3 skills/weekly-aeoncard/render_card.py \ --csv "$CSV" --today "${today}" --window-days "$WINDOW_DAYS" \ --instance "$INSTANCE" --img-link "$IMG_LINK" \ --out "$SVG" \ --png "output/images/weekly-aeoncard-${today}.png" \ --report "output/articles/weekly-aeoncard-${today}.md" \ --dashboard "apps/dashboard/outputs/weekly-aeoncard.json" \ --log "memory/logs/${today}.md")" RC=$? if [ "$RC" -ne 0 ]; then ./notify "weekly-aeoncard: render failed (rc=$RC) — ledger unreadable" exit 0 fiAll writes land under
output/andapps/dashboard/outputs/— paths the run commits. The PNG is a raster copy for inline Telegram delivery (needscairosvgorrsvg-convert); if neither is available the SVG stands alone as the canonical image and the notify degrades to a text recap + link. -
Read the numbers back. Parse
$SUMMARYfor the notification (it holdsweek_human,week_runs,life_human,life_runs,since,cache_read_pct,top_week):WK=$(echo "$SUMMARY" | jq -r .week_human); WKR=$(echo "$SUMMARY" | jq -r .week_runs) LF=$(echo "$SUMMARY" | jq -r .life_human); LFR=$(echo "$SUMMARY" | jq -r .life_runs) SINCE=$(echo "$SUMMARY" | jq -r .since) TOP=$(echo "$SUMMARY" | jq -r '[.top_week[:3][] | "\(.[0]) \(.[1]/1e6|floor)M"] | join(", ")') PNG=$(echo "$SUMMARY" | jq -r '.png // ""') # empty when no rasterizer was available
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 108 lines · 39 tokens per session scan A cc13c31e385d
weekly-aeoncard is a skill published in the GitHub repository aeonfun/aeon (716 stars, last pushed yesterday), licensed MIT. It adds 39 tokens to every session and 2,042 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
hive.image-generation
Required before calling imagegenerate. Create and edit images from a prompt — generate an image, make a picture / logo / illustration / icon / banner / poster / thumbnail / hero image / mockup / product shot / social graphic, or edit / restyle / combine existing images from reference images. Uses OpenAI gpt-image-2…
flowcraft-config
Author, validate, and troubleshoot complete FlowCraft deployment configuration (deploy.yaml with the runtime section, inference/workspace/sandbox/tool sub-documents, core/memory contracts, and graph JSON node wiring). Use when writing or reviewing FlowCraft configs, assembling an agent deployment, adding…
audio-production
Professional audio production for music, podcasts, and sound design. Use when working with audio recording, mixing, mastering, or sound design for any medium.
brand-identity
Brand strategy and identity design for businesses and products. Use when creating brand guidelines, developing visual identity systems, or defining brand positioning.
graphic-design
Professional graphic design principles for digital and print media. Use when creating visual designs, choosing color palettes, typography, layouts, or providing design feedback.
ar-vr-xr
AR/VR/XR development with Unity XR, WebXR, ARKit, ARCore, Meta Quest SDK, and spatial computing. Use when building augmented reality, virtual reality, mixed reality applications, or spatial experiences.