Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/axelfreeman/yandex-wordstat-guidenpx agentmods add skills/axelfreeman/yandex-wordstat-guide/skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/axelfreeman/yandex-wordstat-guide/skill)<a href="https://agentmods.dev/skills/axelfreeman/yandex-wordstat-guide/skill"><img src="https://agentmods.dev/badge/skills/axelfreeman/yandex-wordstat-guide/skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/axelfreeman/yandex-wordstat-guide/skill"><img src="https://agentmods.dev/badge/skills/axelfreeman/yandex-wordstat-guide/skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium analysis-evasion · line 1 Suspicious Unicode normalization or mixed-script contentFix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- medium MCP Rug Pull · line 5 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.00443 |
| Opus 5 | $0.00042 | $0.00221 |
| Sonnet 5 | $0.00017 | $0.00089 |
| Haiku 4.5 | $0.00008 | $0.00044 |
Grade A, and why
wordstat-collector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Wordstat Collector
Что делает
Собирает поисковую статистику Яндекса через API и возвращает структурированные данные. Агент может использовать их для генерации SEO-страниц, рекламных кампаний и контент-планов.
Команды для агента
«Собери семантику по теме [тема] через Wordstat»
«Покажи топ-20 запросов по [ключ]»
«Сгенерируй SEO-страницы на основе семантики из semantic_results.json»
Переменные
WORDSTAT_API_KEY # API-ключ Яндекс.Облака
WORDSTAT_FOLDER_ID # ID каталога (20 символов)
Скрипт
scripts/collect.py — принимает список seed-фраз, возвращает JSON с фразами и частотами.
python3 scripts/collect.py "фраза1" "фраза2"
Лимиты
- 100 запросов в час
- 0.3 sec между запросами
- Не больше 90 запросов за сессию (запас 10%)
Питфоллы
- Все числа приходят строками →
int(count) - folderId ровно 20 символов →
.strip() - Дата для dynamics — последний день месяца/недели
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 51 lines · 84 tokens per session scan A 015addb07494
wordstat-collector is a skill published in the GitHub repository axelfreeman/yandex-wordstat-guide (34 stars, last pushed 18d ago), licensed MIT. It adds 84 tokens to every session and 443 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
minify
Regenerates lib/js/.min.js and lib/css/.min.css via babel-tsf and cleancss-tsf. Use after editing unminified lib/js or lib/css sources, or when the user asks to minify. Do not hand-edit min files.
seo-pipeline-llm
4-stage SEO content pipeline: keyword research → competitor scraping → SEO analysis → content creation. Outputs local files, no CMS integration.
seo-pipeline-bash
One-shot SEO content pipeline: scrape keywords from SERP and produce article markdown files via Browser Use SDK or DuckDuckGo fallback.
marketing-seo
SEO keyword research, content planning, and competitor analysis with anti-hallucination gates.
non-json-content-types
Handle FormData, file uploads, Blob, Uint8Array, and ReadableStream inputs in tRPC mutations. Use octetInputParser from @trpc/server/http for binary data. Route non-JSON requests with splitLink and isNonJsonSerializable() from @trpc/client. FormData and binary inputs only work with mutations (POST).
launch-monitor
Use when the user asks to "monitor my launch", "track our Product Hunt / Hacker News ranking", or "watch the launch window"; runs the T-0 to T+30 window watch — pre-launch instrumentation verification (UTM/event checks, the upstream of RAMP P1), HN rank/points/comments polling with a comments-over-points flamewar…