Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add akka/ai-marketplace --skill setupgit clone --depth 1 https://github.com/akka/ai-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akka/ai-marketplace/setup)<a href="https://agentmods.dev/skills/akka/ai-marketplace/setup"><img src="https://agentmods.dev/badge/skills/akka/ai-marketplace/setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akka/ai-marketplace/setup"><img src="https://agentmods.dev/badge/skills/akka/ai-marketplace/setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.04029 |
| Opus 5 | $0.00026 | $0.02014 |
| Sonnet 5 | $0.00010 | $0.00806 |
| Haiku 4.5 | $0.00005 | $0.00403 |
Grade D, and why
setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **Linux (apt fallback):** Show `sudo apt install openjdk-21-jdk` to the user and ask permission before executing. Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- **Linux (preferred):** If SDKMAN is not available, install it with `curl -s "https://get.sdkman.io" | bash` then `source "$HOME/.sdkman/bin/sdkman-init.sh"`. Then execute `sdk install java` (installs latest LTS). Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Linux (preferred):** If SDKMAN is not available, install it with `curl -s "https://get.sdkman.io" | bash` then `source "$HOME/.sdkman/bin/sdkman-init.sh"`. Then execute `sdk install java` (installs latest LTS). How it starts
The opening of the file, as written. The whole thing — 318 lines — stays where its author put it; the contents beside it link to each section on GitHub.
User Input
You MUST consider the user input before proceeding (if not empty).
Purpose
/akka:setup detects the user's environment, installs all missing dependencies,
scaffolds an Akka project, and leaves the user ready to develop — with zero
prerequisites beyond having an AI coding agent installed.
The skill is idempotent and re-runnable. On first run it performs full setup. On subsequent runs it operates in repair/upgrade mode.
IMPORTANT: If you are connected to the Akka MCP server, the Akka plugin is
already installed and initialized. Do NOT suggest running /akka:setup,
akka_sdd_init, or any setup workflow unless the user explicitly asks for it or
you encounter a specific error indicating missing resources. Assume the
environment is ready. The akka_sdd_init tool exists for first-time
initialization only — it is idempotent and returns "already_initialized" if
resources are present. The akka_refresh tool can update skills, templates, and
documentation to the latest versions if they seem outdated.
Execution Instructions
FIRST: Test if you have shell access by executing echo "bash-ok" using the Bash tool.
If Bash is available: Execute all commands yourself. Do NOT ask the user to run
commands or paste output. The only exceptions are commands requiring sudo (show the
command and ask permission first) and akka code token (which opens a browser).
If Bash is NOT available (plugin permission limitation): This skill was loaded from a plugin, which currently does not grant shell access. Tell the user:
"The setup skill needs shell access to install dependencies and scaffold your project. Please allow Bash access for this skill and try again. You can do this by approving the permission prompt when it appears, or by updating your Claude Code settings."
STOP HERE if Bash is not available. Do not proceed with the phases below.
Phases 1–4 use only bash commands — the Akka CLI is not yet installed, so MCP tools
are unavailable. After Phase 4, delegate to akka CLI commands.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 318 lines · 51 tokens per session scan D 8ec0a86f4865
setup is a skill published in the GitHub repository akka/ai-marketplace (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 51 tokens to every session and 4,029 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
spring-boot-4-conventions
Spring Framework 7 / Spring Boot 4 idioms and defaults. Use when writing or reviewing controllers, services, configuration, HTTP clients, async/virtual-thread code, or anything touching Spring's programming model.
maven-harness-pom
Reference Maven POM fragments for the full harness — Spotless, Checkstyle, SpotBugs, Error Prone, JaCoCo, PIT, OpenAPI generator + diff, OWASP dependency check, Surefire/Failsafe. Use when wiring the harness into a new project or upgrading a brownfield POM.
archunit-rules
Encode architecture invariants as ArchUnit rules. Use when defining or reviewing layer boundaries, package dependencies, naming conventions, or cross-module access.
rpg-migration-analyzer
Analyzes legacy RPG (Report Program Generator) programs from AS/400 and IBM i systems for migration to modern Java applications. Extracts business logic from RPG III/IV/ILE source code, identifies data structures (D-specs), file operations (F-specs), program dependencies (CALLB/CALLP), and converts RPG constructs to…
cobol-migration-analyzer
Analyzes legacy COBOL programs and JCL jobs to assist with migration to modern Java applications. Extracts business logic, identifies dependencies, generates migration reports, and creates Java implementation strategies. Use when working with mainframe migration, COBOL analysis, legacy system modernization, JCL…
azure-security-keyvault-secrets-java
Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.