Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bnomei/kirby-mcp --skill kirby-plugin-developmentgit clone --depth 1 https://github.com/bnomei/kirby-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bnomei/kirby-mcp/kirby-plugin-development)<a href="https://agentmods.dev/skills/bnomei/kirby-mcp/kirby-plugin-development"><img src="https://agentmods.dev/badge/skills/bnomei/kirby-mcp/kirby-plugin-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bnomei/kirby-mcp/kirby-plugin-development"><img src="https://agentmods.dev/badge/skills/bnomei/kirby-mcp/kirby-plugin-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.00489 |
| Opus 5 | $0.00018 | $0.00244 |
| Sonnet 5 | $0.00007 | $0.00098 |
| Haiku 4.5 | $0.00004 | $0.00049 |
Grade A, and why
kirby-plugin-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Kirby Plugin Development
KB entry points
kirby://kb/scenarios/04-share-templates-controllers-via-pluginkirby://kb/scenarios/05-kirbytext-kirbytags-hookskirby://kb/scenarios/15-custom-blocks-nested-blockskirby://kb/scenarios/17-extend-kirbytagskirby://kb/scenarios/59-monolithic-plugin-setupkirby://kb/scenarios/60-plugin-workflow-local-testing
Required inputs
- Plugin id (vendor/name) and scope.
- Extension points (hooks/fields/tags/blocks/sections).
- Distribution plan (project-only or composer package).
Minimal plugin skeleton
Kirby::plugin('vendor/name', [
'hooks' => [],
'blueprints' => [],
'snippets' => [],
]);
Local testing
- Use the local workflow guide to test without publishing.
- Render affected pages and verify plugin registration.
Common pitfalls
- Using inconsistent plugin ids or folder names.
- Registering hooks that assume Panel or API is always enabled.
Workflow
- Define the plugin id (vendor/name), feature scope, and whether it must be reusable across projects.
- Call
kirby:kirby_initand readkirby://rootsto locate plugin roots. - Inspect existing plugins to avoid duplication:
kirby:kirby_plugins_index. - Use extension and hook references:
kirby://extensionsandkirby://extension/{name}kirby://hooksandkirby://hook/{name}
- Search the KB with
kirby:kirby_search(examples: "kirbytext hooks", "extend kirbytags", "custom blocks", "share templates via plugin", "monolithic plugin setup"). - Implement the plugin with a minimal
index.phpregistration, then add blueprints/snippets/assets as needed. - Verify by rendering affected pages with
kirby:kirby_render_pageand confirming the plugin loads without errors.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 54 lines · 37 tokens per session scan A 87c7dc25b47d
kirby-plugin-development is a skill published in the GitHub repository bnomei/kirby-mcp (59 stars, last pushed 11d ago), licensed MIT. It adds 37 tokens to every session and 489 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
defending-applications
Application security defense knowledge for builders. Covers Web/API/GraphQL hardening (XSS/SQLi/SSRF/IDOR/BOLA/Mass Assignment/deserialization/upload/path traversal), authentication/authorization (OAuth 2.0/OIDC/JWT/Session/Cookie/SAML/SSO), and LLM application security (prompt injection, jailbreak, RAG poisoning…
designing-architectures
Architecture knowledge reference covering API design, security architecture, cloud-native patterns, caching strategies, message queues, and data security. Use when designing system architecture, APIs, or cloud-native infrastructure.
backend
Backend engineering judgment, distilled from a stronger model - invoke when CHOOSING a tech stack, language, database, queue, or architecture; designing a service, API, business logic, or schema; making a system production-ready (observability, failure handling, security); or reviewing server-side code and judging…
api-contract-design
Use this skill when freezing the interface between a backend and its clients before parallel work starts, or when changing an endpoint other code already calls - request/response shapes, status codes, error envelope, pagination, filtering, idempotency, versioning, and the breaking-change rules. Covers writing the…
supabase-setup
Use this skill when setting up or changing a Supabase database - schema, migrations, row-level security, seeds, typed clients, or connecting an app to a hosted project. Covers the safe order of operations and the checks that prevent a public table or an unreviewable schema change.
hipson-workflow
Use for structured Codex development workflows with Architect, Executor, and Reviewer roles, especially repo scans, task packets, review reports, verification, and two-Codex handoffs.