Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aptos-labs/aptos-agent-skills --skill create-aptos-projectgit clone --depth 1 https://github.com/aptos-labs/aptos-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aptos-labs/aptos-agent-skills/create-aptos-project)<a href="https://agentmods.dev/skills/aptos-labs/aptos-agent-skills/create-aptos-project"><img src="https://agentmods.dev/badge/skills/aptos-labs/aptos-agent-skills/create-aptos-project/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aptos-labs/aptos-agent-skills/create-aptos-project"><img src="https://agentmods.dev/badge/skills/aptos-labs/aptos-agent-skills/create-aptos-project.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.01588 |
| Opus 5 | $0.00063 | $0.00794 |
| Sonnet 5 | $0.00025 | $0.00318 |
| Haiku 4.5 | $0.00013 | $0.00159 |
Grade A, and why
create-aptos-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create Aptos Project Skill
Purpose
Scaffold new Aptos projects using npx create-aptos-dapp. This is the mandatory first step when a user wants to
build any new Aptos app, dApp, or project — regardless of how they phrase it.
ALWAYS
- Use
npx create-aptos-dappto scaffold — NEVER create projects from scratch manually - Ask the user about project type, framework, and network before scaffolding
- Verify
.envis in.gitignorebefore any git operations - Use the same network for both
create-aptos-dappandaptos init - Follow the full Build a dApp workflow after scaffolding (contracts, tests, audit, deploy, frontend)
NEVER
- Skip scaffolding — even for "simple" projects, always start with
create-aptos-dapp - Create project structure manually — the boilerplate template handles this
- Display or read private keys — use
"0x..."as placeholder - Run
git add .orgit add -Awithout first verifying.envis in.gitignore
Decision Tree
Before running the scaffold command, gather these inputs from the user:
1. Project Name
Derive from the user's description or ask directly. Use kebab-case (e.g., habit-tracker, nft-marketplace).
2. Project Type
| Option | When to Use |
|---|---|
| Fullstack (default) | User wants a frontend + smart contracts |
| Contract-only | User only wants Move smart contracts (no frontend) |
3. Framework (fullstack only)
| Option | When to Use |
|---|---|
| Vite (default) | Default choice, lighter setup |
| Next.js | User asks for Next.js or SSR |
4. Network
| Option | When to Use |
|---|---|
| devnet (default) | Development and testing |
| testnet | Pre-production, user explicitly asks |
| mainnet | Production, user explicitly asks |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 173 lines · 126 tokens per session scan A 4d44a52cb6ba
create-aptos-project is a skill published in the GitHub repository aptos-labs/aptos-agent-skills (19 stars, last pushed 2mo ago), licensed MIT. It adds 126 tokens to every session and 1,588 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
official-sui-skills
Pointer to the official Mysten Labs skills for building on Sui — language fundamentals, object model, PTBs, SDKs, publishing, upgrades, frontend integration, accessing on-chain data. Maintained upstream at github.com/MystenLabs/skills; pinned to the same ref the audit catalog derives from (see…
sui-and-move-tools
Use to get bytecode for a deployed Sui package and produce a disassembled working view. One GraphQL call fetches every module's raw bytecode bytes; sui move disassemble (already on the system, running sui prompt) produces .asm files for analysis. Trigger on "fetch this package's bytecode", "get me the .mv for package…
web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for…
sora-taira-testnet
Work against the SORA Taira testnet through its deployed Torii MCP endpoint for live account, asset, alias, contract, governance, Musubi package-registry, and transaction workflows. Use when Codex needs to inspect or mutate the Taira testnet, verify or add https://taira.sora.org/v1/mcp, prefer the curated iroha. tool…
mochi-local-sandbox
Bring up and use a Mochi-managed local Iroha sandbox plus its local Torii MCP endpoint. Use when Codex needs a reliable local devnet, needs to print or verify the codex mcp add mochi-local --url ... command, or should consume the generated .env.local and .mochi/generated/ bootstrap files for local-only development.
TronScan Data Lookup
Query TRON blockchain data via the TronScan API — accounts, transactions, tokens, blocks, contracts, transfers, and chain statistics.