Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/boshu2/agentops/skill-buildernpx skills add boshu2/agentops --skill skill-buildergit clone --depth 1 https://github.com/boshu2/agentopsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00071 | $0.01646 |
| Opus 5 | $0.00036 | $0.00823 |
| Sonnet 5 | $0.00014 | $0.00329 |
| Haiku 4.5 | $0.00007 | $0.00165 |
Grade A, and why
skill-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Builder — Create, heal, and audit skill packages
skill-builder owns the full structural lifecycle of one skills/<slug>/
source package: create it, verify its structure, repair owned projections, and
audit its content discipline. It does not schedule work, allocate writers,
operate Git, validate a software candidate, promote learnings, or decide what
happens after a failure.
Before creating a new root, search skills/*/SKILL.md for an existing owner.
Extend an existing skill when it already owns the requested behavior.
Modes
| Trigger phrases | Mode | Entry point |
|---|---|---|
| "create a skill", "scaffold skill", "new skill" | create (build) | scripts/build.sh |
| "absorb external skill" | create (absorb-external) | scripts/build.sh |
| "check skill package" | check | scripts/heal.sh --check [--strict] |
| "heal skill", "repair skill hygiene" | heal | scripts/heal.sh --fix |
| "audit skill structure" | audit | scripts/audit.sh |
Constraints
- Create exactly one source package because metadata must have one canonical owner.
- Treat external skills as structural signals only because clean-room output must not copy names, prose, prompts, scripts, or examples.
- Regenerate projections once and stop because validation, revision, Git, and delivery remain caller-owned.
- Check and audit modes never mutate files; fix mode changes only an explicit source target and its owned projections, because source behavior remains human-authored.
Create mode
Choose exactly one build input:
from-scratch <slug>creates a blank source package.from-template <slug> --like <existing-slug>uses the existing skill only for metadata defaults; it does not copy its prose.absorb-external <slug> --from <path>verifies the source exists, then creates a clean-room blank package without copying names, prose, prompts, scripts, or examples.
The caller may set SKILL_TIER, SKILL_DEPENDENCIES,
SKILL_CAPABILITIES, and SKILL_EFFECTS. Values that represent lists must be
JSON arrays.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 184 lines · 71 tokens per session scan A d191ad1ea7e4
skill-builder is a skill published in the GitHub repository boshu2/agentops (431 stars, last pushed 4d ago), licensed Apache-2.0. It adds 71 tokens to every session and 1,646 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
enhance
Audit and tighten agent/plugin surfaces. Use when the user asks to enhance a plugin config, agent definition, skill, or CLAUDE.md.
contexts
Use when the user says "get context on X", "how does X work", or wants architectural orientation before coding.
book-to-skill
Use when turning a book, course, whitepaper, or comparable source document into a reusable agent skill: the user names a source and asks to distill it, encode its method, or build an agent that works the way it prescribes. Classifies the source as procedure or reference, writes a validated SKILL.md, and proves the…
dedup-skills
Ledger-first dedup of a skills/ or prompt-directory tree. Use when the user asks to dedup skills, find rules repeated across or within skill files, or check whether skills contradict each other.
ai-collab-protocols
Surface in-task AI collaboration protocols one tactic at a time, replacing ambiguous references with durable, recoverable handles.
autobahn
Carve the unsafe part out of a task up front, then run the safe remainder at full strength instead of running the whole thing timidly. Use when a task mixes reversible work with something irreversible or out of scope, such as a schema migration, a deletion, or a change to credentials or data at rest, or when the user…