delegate-skills is a toolkit for assigning coding tasks to separate agent command-line tools while keeping control of review and commits. It is for developers who want to organize installed implementers into lanes for work such as features, tests, or UI, then delegate tasks by lane or directly. The catalogue entries define the setup and delegation workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add amElnagdy/delegate-skills --skill zcode-delegategit clone --depth 1 https://github.com/amElnagdy/delegate-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/amelnagdy/delegate-skills/zcode-delegate)<a href="https://agentmods.dev/skills/amelnagdy/delegate-skills/zcode-delegate"><img src="https://agentmods.dev/badge/skills/amelnagdy/delegate-skills/zcode-delegate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/amelnagdy/delegate-skills/zcode-delegate"><img src="https://agentmods.dev/badge/skills/amelnagdy/delegate-skills/zcode-delegate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 19 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 62 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.02545 |
| Opus 5.5 | $0.00050 | $0.01018 |
| Sonnet 5.5 | $0.00025 | $0.00509 |
| Haiku 4.5 | $0.00012 | $0.00254 |
Grade A, and why
zcode-delegate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ZCode Delegate
You are the orchestrator. This skill lets you hand a bounded coding task to a separate implementer — the Z.AI ZCode CLI — then review what it produced and land it yourself. You write the brief and own the judgment; ZCode does the typing; you verify and commit.
Nothing here is specific to one orchestrating agent. The loop needs only the ability to run a shell command and read a file. (It is designed for and run on Claude Code; treat other orchestrators as designed-for, not yet proven.)
When NOT to use this
- The task is small enough to just do inline — delegation overhead is not worth it.
- ZCode is not installed, or its CLI has no model provider configured.
- You want to write the code yourself, or you only need a review.
Prerequisites (check once)
- ZCode is installed. The CLI ships inside the desktop app — it is not on PATH and not on
npm. The relay resolves it in this order:
--zcode-path <file>orZCODE_CLIfirst, then PATH, then the installed app bundle. On Linux the app is an AppImage with no fixed install path, so the flag or the environment variable is required there — the relay guesses nothing. - A model provider is configured for the CLI, with a key it can actually reach. Being signed into the desktop app is not enough — see below.
- You are in (or will point
--cdat) the target git repository.
The relay records the CLI version and how it was resolved into result.json, so a surprising
install is visible after the fact.
Authenticating the headless CLI
Signing into the ZCode desktop app does not authenticate the CLI this relay drives. The CLI
keeps its own config at ~/.zcode/cli/config.json, separate from the desktop app's, and nothing
bridges the two. zcode login is the intended path, but where it fails with OAuth response is not valid JSON the way in is a Z.AI API key.
Two pieces are needed, and they are separate:
- The provider block must exist in
~/.zcode/cli/config.json. It defines the provider, its endpoint and its models — the environment cannot supply this:
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +11 lines e5decc1cfcc3
- 1mo ago First seen · 185 lines · 124 tokens per session scan A 623b66c309fd
zcode-delegate is a skill published in the GitHub repository amElnagdy/delegate-skills (2,441 stars, last pushed 6d ago), licensed MIT. It adds 124 tokens to every session and 2,545 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
openai-docs
Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, latest/current/default-model prompting guidance, or model upgrade and prompt-upgrade guidance; use…
visualize
Create visualizations and interactive tools directly in conversation. Use when asked to show how something works, make simulators or labs, maps, plots, charts or graphs, comparisons, UI mockups, scenarios, adjustable inputs, and exploration beyond regular text.
doc-typeset
A document formatter that turns text and design settings into complete, styled HTML. It includes templates for contracts, academic papers, official documents, business reports, meeting notes, research reports, and annual reports.
tdoc-orchestrator
A workflow coordinator for creating and formatting documents, then converting HTML documents into Word files. It identifies the user's document task and sends each stage to the appropriate specialist.
3D模型与视频特效
A tool for generating 3D models from text or images and applying preset animated effects to pictures. It does not generate ordinary images or full videos.
Spreadsheets
Create, edit, analyze, and verify standalone spreadsheet files or Google Sheets-ready workbooks, including .xlsx, .xls, .csv, and .tsv. Do not use for live controlling Microsoft Excel app or a live Excel session.