Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add atman-33/workhub --skill install-skillgit clone --depth 1 https://github.com/atman-33/workhubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atman-33/workhub/install-skill)<a href="https://agentmods.dev/skills/atman-33/workhub/install-skill"><img src="https://agentmods.dev/badge/skills/atman-33/workhub/install-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atman-33/workhub/install-skill"><img src="https://agentmods.dev/badge/skills/atman-33/workhub/install-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.00327 |
| Opus 5 | $0.00009 | $0.00163 |
| Sonnet 5 | $0.00003 | $0.00065 |
| Haiku 4.5 | $0.00002 | $0.00033 |
Grade A, and why
install-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Install a Claude Code skill from a GitHub skills repository URL.
Steps
-
Route the input. Decide whether the user gave a GitHub tree URL or a repo/skill reference.
- Completion criterion: the input is classified as exactly one of URL or reference.
-
Extract repo and skill path. For a tree URL of the form
https://github.com/OWNER/REPO/tree/<ref>/skills/<category>/<skill>, extractOWNER/REPOand the path underskills/— for example,productivity/writing-great-skills. If the user gaveOWNER/REPO <path>directly, use it as-is.- Completion criterion: both the repository and the skill path are identified.
-
Install for Claude Code. Run:
gh skill install <repo> <skill-path> --agent claude-code- Completion criterion: the command exits successfully.
-
Report result. Show the installed skill path and any warnings.
- Completion criterion: the user can see whether the install succeeded.
Failure modes
ghmissing or unauthenticated: stop and ask the user to rungh auth login.- URL with no
skills/segment: stop and ask for a repo/skill reference. gh skill installfails: print the full error and do not retry.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 30 lines · 17 tokens per session scan A 05c99ef08eef
install-skill is a skill published in the GitHub repository atman-33/workhub (2 stars, last pushed today), licensed MIT. It adds 17 tokens to every session and 327 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
gonavi-cli
Operate databases through the GoNavi headless CLI — the gonavi executable shipped in verified GitHub Release archives. Covers listing/adding/importing saved connections, running SQL queries against saved connections or ad-hoc connection files, exporting result sets to csv/json/md/html/xlsx, batch-executing SQL files…
xiaohongshu-image-creator
An image-making assistant for Xiaohongshu, a Chinese social platform for lifestyle, product, and educational posts. It creates vertical covers and supporting images matched to the post’s topic, audience, and visual style.
x-cr
A software-correctness investigation skill for finding why code behaves differently from what was expected. It uses evidence from code paths, specifications, tests, logs, and changes to assess possible causes.
design
Create a doc-as-code design package from a PRD or SPEC. Conditionally generates C4 diagrams (Context/Container/Component), sequence diagrams, ER diagram + Data Dictionary, OpenAPI 3.0, AsyncAPI 3.0, ADRs, domain glossary, state diagrams, and deployment view as Mermaid-rendered Markdown files. Use when PM mentions…
recall
Retrieve session memory across 4 modes — TEMPORAL (date browsing), KEYWORD (FTS lookup), DEEP (cross-session synthesis), LOAD (specific file). Trigger on "what did I do yesterday/last week", "why did we...", "remind me...", "find the memo about...", "last time we...", "patterns across projects", "load the X topic". Do…
shipyard-handoff
Captures session context into .shipyard/HANDOFF.md so the next session can resume without losing progress.