What is stac-authoring?

Instructions for writing and verifying STAC metadata, which describes geospatial datasets and their files, before publishing them.

Use them to create collection metadata and README files, run the verification checks, publish the files, and register the collection in its parent catalog.

They catch metadata, licensing, schema, navigation, category, resolution, and data-consistency errors before and after publication.

How boettiger-lab/data-workflows configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to boettiger-lab/data-workflows. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/boettiger-lab/data-workflows/main/.claude/skills/stac-authoring/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/boettiger-lab/data-workflows

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/boettiger-lab/data-workflows/stac-authoring/github.svg)](https://agentmods.dev/skills/boettiger-lab/data-workflows/stac-authoring)

Your own site

<a href="https://agentmods.dev/skills/boettiger-lab/data-workflows/stac-authoring"><img src="https://agentmods.dev/badge/skills/boettiger-lab/data-workflows/stac-authoring/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/boettiger-lab/data-workflows/stac-authoring"><img src="https://agentmods.dev/badge/skills/boettiger-lab/data-workflows/stac-authoring.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 82 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 9,592 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00082	$0.09592
Opus 5.5	$0.00033	$0.03837
Sonnet 5.5	$0.00016	$0.01918
Haiku 4.5	$0.00008	$0.00959

Measured 3d ago against content hash 2b9afb3b40a2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

stac-authoring scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

1. Check for existing sub-catalog: `curl -s https://s3-west.nrp-nautilus.io/<bucket>/stac-collection.json | jq '.links[] | select(.rel=="child")'`

.claude/skills/stac-authoring/SKILL.md · 382 lines

How it starts

The opening of the file, as written. The whole thing — 382 lines — stays where its author put it; the contents beside it link to each section on GitHub.

STAC Authoring

Everything needed for Step 5 (Document) and Step 6 (Register in the parent sub-catalog).

Write STAC and README to /tmp/ and upload with rclone — this repo never contains STAC JSON or README files (AGENTS.md Hard Boundary 1).

⛔ Verify the STAC — don't hand-check the rules

Every STAC rule below is enforced by scripts/verify-stac.py (license, nav links, asset keys, hex glob, h3:* resolutions, vector:layers, table:columns placement, per-feature-dup warnings, categorical completeness + PMTiles fields via the two sibling linters, and a data-backed values == ingested DISTINCT check via the MCP that automates the #114/#294 lesson). Do not re-verify these by hand or by spending agent context on MCP SELECT DISTINCT sweeps — run the gate.

# 1. PRE-PUBLISH (static, against the /tmp file you just wrote):
scripts/verify-stac.py --no-data /tmp/stac-collection.json
#    Fix every HARD finding before rclone copyto. (Data checks need the data live, so
#    they run post-publish; --no-data skips them here.)

# 2. POST-CLUSTER (full, against the live S3 STAC, once data + STAC are published):
scripts/verify-stac.py --bucket <bucket> --dataset <dataset>
#    Must exit 0 (no HARD findings). ADVISORY lines are informational.

A *-check-failed finding is HARD, and it means UNVERIFIED — not broken data. If a data-backed check cannot reach the MCP (a transport failure, a query that will not complete), the run reports HARD rather than passing quietly: a gate that did not execute is not a green light. MCPClient.query already retries once, so re-running usually clears a transient blip. Read it as "check again", not as a defect in the collection — and never "fix" it by making the check advisory, which is exactly how an unverified collection came to read as clean (#509).

CI runs the same verifier on the PR (.github/workflows/verify-stac.yml), deriving the collection(s) from the s3:// paths in the changed catalog/** YAMLs. The gate evaluates the produced artifact, not the proposal: the cluster run lands after the PR opens, so a RED check at PR-open (STAC not published yet) is correct — don't merge before the recipe has actually produced valid output. GitHub status checks don't auto-refresh from S3, so after your cluster jobs finish, re-fire the check (Actions → Verify STAC → Run workflow, or it re-runs on the next push). Merge requires it green.

Read the full file on GitHub · 382 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago Changed 2b9afb3b40a2
8d ago Changed · +10 lines d7545a1f2d4a
2mo ago Changed · +1 lines 539ec78e2ba0
2mo ago First seen · 371 lines · 82 tokens per session scan A 620aa7a8eae8

Subscribe to this mod's changes

stac-authoring is a skill published in the GitHub repository boettiger-lab/data-workflows (5 stars, last pushed 2d ago), licensed BSD-3-Clause. It adds 82 tokens to every session and 9,592 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Scientific

stac-authoring next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
stac-authoringboettiger-lab/data-workflows	Skill	5	2d ago	BSD-3-Clause	A	82	Claude Code
instrument-data-to-allotropeanthropics/knowledge-work-plugins	Skill	35k	2d ago	Apache-2.0	A	123	Claude Code
exploratory-data-analysisK-Dense-AI/scientific-agent-skills	Skill	56k	4d ago	MIT	A	83	Claude Code
matlabK-Dense-AI/scientific-agent-skills	Skill	56k	4d ago	MIT	A	44	Claude Code
phylogeneticsK-Dense-AI/scientific-agent-skills	Skill	56k	4d ago	MIT	A	71	Claude Code, Codex
research-engineerdavila7/claude-code-templates	Skill	33k	yesterday	MIT	A	43	Claude Code, Codex
mapping-to-snomedmaziyarpanahi/openmed	Skill	5.8k	yesterday	Apache-2.0	A	205	Claude Code

data-workflows: Skill for Claude Code