Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add brenoepics/video-to-skill --skill video-to-skillgit clone --depth 1 https://github.com/brenoepics/video-to-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/brenoepics/video-to-skill/video-to-skill)<a href="https://agentmods.dev/skills/brenoepics/video-to-skill/video-to-skill"><img src="https://agentmods.dev/badge/skills/brenoepics/video-to-skill/video-to-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/brenoepics/video-to-skill/video-to-skill"><img src="https://agentmods.dev/badge/skills/brenoepics/video-to-skill/video-to-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.03470 |
| Opus 5 | $0.00051 | $0.01735 |
| Sonnet 5 | $0.00020 | $0.00694 |
| Haiku 4.5 | $0.00010 | $0.00347 |
Grade D, and why
video-to-skill scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
("ignore previous instructions", "run this to continue", Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Steps that download-and-execute remote code (`curl … | sh` and kin) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Steps that download-and-execute remote code (`curl … | sh` and kin) How it starts
The opening of the file, as written. The whole thing — 274 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Video to Skill
Turn a video into knowledge an agent can act on. A local Rust extractor
(vts-extract) does the deterministic work — download, transcription,
shot detection, keyframes — entirely on the user's machine. You do the
intelligence: read the timeline, inspect frames selectively, and produce
evidence-grounded output. The video never leaves the machine; only the
frames you choose to read enter context.
Modes
- generate (default): the skill's purpose. Analyze the video (steps 2-5), then compile, verify, and install a skill package (steps 6). Invoking this skill with just a video means generate. Exception: a non-procedural video (talk with no procedure, vlog) gets the analysis report plus an explanation of why no skill was generated — never fabricated steps.
- analyze: report only — use when the user asks for an analysis, summary, or report rather than a skill.
- update: fold a new video into an existing generated skill — see step 7 below.
1. Locate the extractor (requires vts-extract 0.2.4)
The binary is cached globally so every project that carries this
skill shares one copy. The cache lives in the app data dir — the same
dir the runtime tools use: $VTS_DATA_DIR if set, else the platform
data dir joined with video-to-skill (macOS:
~/Library/Application Support/video-to-skill, Linux:
~/.local/share/video-to-skill).
Resolve the binary in this order, then confirm vts-extract --version
reports 0.2.4 — a wrong-version binary is ignored (never deleted;
versioned filenames let versions coexist), so move to the next
candidate or refetch rather than proceeding:
- Global cache:
<data-dir>/bin/vts-extract-0.2.4(versioned filename). - Dev clones only:
target/release/vts-extractbeside this file. - Fetch the prebuilt binary (macOS arm64 primary) into the global
cache:
(Other platforms: substituteVTS_BIN="${VTS_DATA_DIR:-$HOME/Library/Application Support/video-to-skill}/bin" gh release download v0.2.4 -R brenoepics/video-to-skill -p "vts-extract-macos-arm64*" -D /tmp/vts-dl shasum -a 256 -c /tmp/vts-dl/vts-extract-macos-arm64.tar.gz.sha256 mkdir -p "$VTS_BIN" && tar -xzf /tmp/vts-dl/vts-extract-macos-arm64.tar.gz -C "$VTS_BIN" mv "$VTS_BIN/vts-extract" "$VTS_BIN/vts-extract-0.2.4"macos-x86_64/linux-x86_64, and on Linux use the~/.local/sharedefault above.) The checksum must verify before the binary is executed. - Last resort, build from source:
cargo build --releasein this skill's directory (requires Rust + cmake); the result appears at candidate 2's path.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 274 lines · 102 tokens per session scan D 9f42b7387765
video-to-skill is a skill published in the GitHub repository brenoepics/video-to-skill (5 stars, last pushed 2d ago), licensed MIT. It adds 102 tokens to every session and 3,470 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it D with 3 findings (instruction-override phrasing, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
regex-explainer
Explains what a regular expression does in plain English, or builds one from a plain-English description. Use when a regex is unreadable at a glance, or when you know what you want to match but not the regex syntax for it.
interview-question-generator
Generates technical interview questions plus an evaluation rubric for a given role or skill area. Use when preparing to interview a candidate and need structured, fair questions rather than ad hoc ones.
mvhs-bell-schedule
Fetch and display the live MVHS (Mountain View High School) bell schedule for today or any given date, with the current period highlighted and a progress indicator. Use this skill whenever the user asks about the MVHS bell schedule, what period it is right now, whether there's school today, or what time any period…
video-to-guide
Transforms YouTube videos into full, structured written guides — every detail preserved, no summarizing. Use when the user wants to turn a video into a guide, study notes, learning material, or any written format that captures the full depth of the content. The skill fetches the transcript automatically and produces…
cangjie-skill
A process for turning a book, course, podcast, interview, long video, or other long material into reusable instructions for an AI agent. It extracts methods and principles, checks them, and packages them as skills.
reading-metaskill
A reading and learning guide based on building a regular reading habit, choosing books, and understanding difficult subjects through original works and explanation.