Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alpacahq/alpaca-trade-api-js --skill starter-dashboardgit clone --depth 1 https://github.com/alpacahq/alpaca-trade-api-jsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alpacahq/alpaca-trade-api-js/starter-dashboard)<a href="https://agentmods.dev/skills/alpacahq/alpaca-trade-api-js/starter-dashboard"><img src="https://agentmods.dev/badge/skills/alpacahq/alpaca-trade-api-js/starter-dashboard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alpacahq/alpaca-trade-api-js/starter-dashboard"><img src="https://agentmods.dev/badge/skills/alpacahq/alpaca-trade-api-js/starter-dashboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 25 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 31 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 55 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.00742 |
| Opus 5 | $0.00037 | $0.00371 |
| Sonnet 5 | $0.00015 | $0.00148 |
| Haiku 4.5 | $0.00007 | $0.00074 |
Grade A, and why
starter-dashboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Alpaca Starter Dashboard
Create a local Next.js dashboard for Alpaca paper trading and market data demos.
The generated app uses the published @alpacahq/alpaca-trade-api package and calls
the Trading API and Market Data API directly through the SDK.
Workflow
- Confirm the target directory and app name.
- Create the app locally with
scripts/scaffold.ts. - Default to paper trading (
APCA_PAPER="true"). Do not configure live trading. - Report the target path and give next commands. Do not print secrets from
.env.local.
Run The Scaffolder
From this skill directory:
npx tsx scripts/scaffold.ts \
--target-directory /path/to/my-alpaca-dashboard \
--app-name my-alpaca-dashboard
If the local runtime supports it, node scripts/scaffold.ts or
bun scripts/scaffold.ts are also acceptable. Prefer npx tsx for Node 20
compatibility.
The script reads these credential environment variables when flags are omitted:
APCA_API_KEY_IDAPCA_API_SECRET_KEY
If credentials are not locally available, pass --allow-placeholder-credentials;
the generated .env.local will contain placeholders the user must fill before
running the app.
Useful flags:
--create-subdirectory: treat--target-directoryas the parent and createtarget/app-name.--key-id/--secret: write explicit paper credentials without reading environment variables.--paper: set the generatedAPCA_PAPERvalue. Defaults totrue; keep this enabled for demos.
The target directory may already contain unrelated files. The scaffolder merges
the template into the target, but refuses to overwrite any existing generated
path, including .env.local.
Common failures:
- TypeScript runner unavailable: use
npx tsx,nodewith native TypeScript support, orbun. - Missing credentials: set
APCA_API_KEY_IDandAPCA_API_SECRET_KEY, pass--key-id/--secret, or use--allow-placeholder-credentials. - Invalid app name: use a lowercase npm package name with no spaces, uppercase letters, leading dot, or leading underscore.
- Unsafe target: the target must not be a file or symlink, and generated paths must not already exist.
What ships with it
22 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/scaffold.ts 8.4 KB runs code
- template/.env.example 98 B
- template/.gitignore 90 B
- template/app/globals.css 5.4 KB
- template/app/layout.tsx 982 B
- template/app/orders/page.tsx 5.7 KB
- template/app/page.tsx 5.2 KB
- template/app/positions/page.tsx 4.6 KB
- template/app/stocks/[symbol]/page.tsx 11 KB
- template/app/stocks/page.tsx 4.7 KB
- template/app/trade/actions.ts 3.0 KB runs code
- template/app/trade/page.tsx 5.8 KB
- template/components/nav.tsx 2.6 KB
- template/components/ui.tsx 3.5 KB
- template/lib/alpaca.ts 1.0 KB runs code
- template/lib/format.ts 2.6 KB runs code
- template/next-env.d.ts 184 B runs code
- template/next.config.ts 104 B runs code
- template/package.json 667 B
- template/postcss.config.mjs 94 B runs code
- template/README.md 1.5 KB
- template/tsconfig.json 600 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 80 lines · 75 tokens per session scan A 89bb9e9b5a77
starter-dashboard is a skill published in the GitHub repository alpacahq/alpaca-trade-api-js (601 stars, last pushed today), licensed Apache-2.0. It adds 75 tokens to every session and 742 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nfeio-node-sdk
NFE.io Node.js SDK integration expert (package: nfe-io). MUST trigger when: code imports 'nfe-io' or references NfeClient; user mentions NFE.io, NFS-e, NF-e, CT-e, CF-e, CFe-SAT, nota fiscal, nota fiscal eletronica, Brazilian invoice, fiscal document, electronic invoice Brazil, CNPJ lookup, CPF lookup, service…
alien-plugg-x402
38 paid x402 API endpoints for AI agents — Zora crypto analysis, Robinhood Chain tokenized stocks, on-chain intelligence, whale tracking, and utilities. MCP-compatible. Flat $0.003/call via USDC micropayments on Base.
3d-web-experience
Expert in building 3D experiences for the web - Three.js, React Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product configurators, 3D portfolios, immersive websites, and bringing dep.
angular-migration
Master AngularJS to Angular migration, including hybrid apps, component conversion, dependency injection changes, and routing migration.
crypto-signal-api
Real-time cryptocurrency trading signal generator. Analyzes 6 technical indicators (RSI, MACD, EMA, Bollinger Bands, Stochastic RSI, Volume) from Binance live data to produce BUY/SELL/HOLD signals with confidence scores. Available as REST API and MCP server.
social-media-intelligence
Social media intelligence: financial signal extraction from Twitter/X, Telegram, Discord, and Reddit for sentiment-driven trading strategies.