Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/archcore-ai/plugin/initnpx skills add archcore-ai/plugin --skill initgit clone --depth 1 https://github.com/archcore-ai/pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00179 | $0.15082 |
| Opus 5 | $0.00089 | $0.07541 |
| Sonnet 5 | $0.00036 | $0.03016 |
| Haiku 4.5 | $0.00018 | $0.01508 |
Grade E, and why
init scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
> curl -fsSL https://archcore.ai/install.sh | bash Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`bin/detect-host` resolves the current host from environment only (never cwd or stdin — Cursor guarantees neither) and prints exactly one token: `claude-code` | `cursor` | `codex-cli` | `__UNKNOWN__`. **A GitHub Copilot Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
**On `copilot`, verify the result instead of assuming it.** Everywhere else a failed wiring costs convenience — the plugin's own MCP server still answers. On this host it costs the entire document surface (`copilot-mcp-a Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> curl -fsSL https://archcore.ai/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 441 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/archcore:init
First-time onboarding. Detects repo scale (small / medium / large) and shape, composes a scale-appropriate seed of .archcore/ documents, shows them in one preview, and creates them on a single confirm — so the code-alignment hook injection and per-command grounding have substance and the relation graph is live from day one. The same confirm also installs host wiring (project MCP config, SessionStart hook, usage hint — the same files archcore init writes), so the repo works for CLI-only teammates. Per magic-first-day-init.adr: extractive facts are composed in full; the top hotspot modules get real specs (synthesized only after confirm); the overview is an index, never a prose blob. Nothing is written before confirm. Exact per-mode output is in the Routing Table below.
Arguments
--depth=light|standard|deep— synthesis budget (defaultstandard), orthogonal to--mode. See the Depth axis section below. Also settable via thedepth:<tier>toggle in the preview.--mode=small|medium|large— force a mode, overriding auto-detection.--domain=<slug>— re-run focused on one domain (large repos): scopes data-model + hotspot specs to that domain's tree, tops up only its docs. Bypasses the "already seeded" early-exit.--refresh— re-run on an already-seeded repo to add facts that appeared since the first init (a new schema, config, or modules) — and to retrofit host wiring on repos seeded before wiring existed. Bypasses the early-exit; existing docs are skipped, missing ones composed.
When to use
- Empty
.archcore/— the SessionStart nudge points here. - First session on a fresh clone / fresh install.
- User says: "initialize archcore", "set up archcore", "seed archcore", "first-time setup", "what should I do first".
Not init (route elsewhere):
- Recording a specific decision →
/archcore:document. - Planning a feature →
/archcore:plan. - Documenting one module →
/archcore:document. - Codifying a team standard →
/archcore:document(offers rule + guide continuation). - Reading applicable context before coding → automatic; the code-alignment hook injects it on file edits.
- Docs health audit →
/archcore:review.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 441 lines · 179 tokens per session scan E 7940fc74638d
init is a skill published in the GitHub repository archcore-ai/plugin (53 stars, last pushed 15d ago), licensed Apache-2.0. It adds 179 tokens to every session and 15,082 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it E with 4 findings (downloads and executes remote code, reads agent configuration directories, reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
shark
The Shark Pattern — universal non-blocking execution for any AI coding agent. Spawn remoras for slow tools, keep the main agent swimming. Works with Claude Code, Codex, Gemini CLI, Cursor, Aider, OpenClaw.
auth-web-cloudbase
CloudBase Web Authentication Quick Guide for frontend integration after auth-tool has already been checked. Provides concise and practical Web authentication solutions with multiple login methods and complete user management.
taiyi-ui-design
TaiyiForge 第 4 阶段 — UI/UX 契约，产出 UI-DESIGN.md。四端通用。.
browse-and-evaluate
Use when exploring the ai-agent-skills catalog to find, compare, and evaluate skills before installing. Always use --fields to limit output size and --dry-run before committing to an install.
telnyx-messaging-hosted-curl
Set up hosted SMS numbers, toll-free verification, and RCS messaging. Use when migrating numbers or enabling rich messaging features. This skill provides REST API (curl) examples.
render-3d-product-showcase
Assemble a premium 3D product-showcase ad from a config — four beat clips (an orbiting hero rotation, a macro push-in, a physics reveal, a typographic close) normalized to the brand-color canvas, hard-concatenated in order, closed on a deterministic Playwright brand end card, and mixed under one instrumental bed at…