Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/buildinternet/uploads/uploads-clinpx skills add buildinternet/uploads --skill uploads-cligit clone --depth 1 https://github.com/buildinternet/uploadsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00215 | $0.16119 |
| Opus 5 | $0.00108 | $0.08059 |
| Sonnet 5 | $0.00043 | $0.03224 |
| Haiku 4.5 | $0.00021 | $0.01612 |
Grade A, and why
uploads-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 1,079 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Uploading files to uploads.sh and embedding in GitHub
What this does and why
GitHub's native image hosting (github.com/user-attachments/…) is only reachable
through an authenticated browser session — there is no gh CLI or REST endpoint
for it. So any image URL you put in a PR/issue body written with gh … --body-file
must already point at something publicly hosted.
This skill covers both transports: the uploads CLI (local files, git,
localhost) and the hosted MCP at https://agents.uploads.sh/mcp (bytes you
already have, or a public HTTPS URL to fetch, no checkout). Both PUT to the
uploads.sh API and return a stable public URL plus ready-to-paste markdown.
For PRs and issues the managed attachments comment is available on both.
The CLI can fall back to local gh. Hosted MCP is bot-only.
MCP vs CLI
Same product, two transports. Skills do not install a binary.
| Need | Use | Why |
|---|---|---|
| Bytes already in context (ChatGPT attachment, base64) | Hosted MCP put |
files: [{ filename, contentBase64 }]. Pass repo + (pr | branch). No git inference. |
| File already at a public HTTPS URL | CLI put --url or hosted MCP put |
CLI: uploads put --url https://… --pr 123. Hosted: { contentUrl } (filename optional when the URL path has a leaf). Worker/CLI fetches; no auth headers. Hosted rejects private/internal hosts. CLI (and stdio MCP) also fetch http://localhost / 127.0.0.1 / *.localhost. LAN and link-local stay rejected. |
| List, find, metadata, comment, promote | Either | Hosted: list, find_files, get_metadata / set_metadata, comment, promote. CLI: uploads list / find / meta / comment / attach --promote. |
| Local path or current-branch attach | CLI | Hosted server has no filesystem and no attach tool. Use put instead. |
localhost / private-network screenshot |
CLI uploads screenshot --via local |
Remote render cannot reach your machine. |
| Selector annotate on a live page | CLI uploads screenshot --annotate --via local |
Remote backend rejects selector-bearing specs. |
| Neither transport | Stop | Do not treat npm install -g as the ChatGPT path. OAuth on https://agents.uploads.sh/mcp is the published remote path. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 1,079 lines · 215 tokens per session scan A c343a18109bf
uploads-cli is a skill published in the GitHub repository buildinternet/uploads (19 stars, last pushed yesterday), licensed Apache-2.0. It adds 215 tokens to every session and 16,119 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
open-pr
Take a cloudflare/agents GitHub issue plus any repro findings and one-shot a fix PR — branch, change, test, push, and open the PR linked to the issue.
release-notes
Draft short release notes from a list of changes. Use when the user asks for changelogs, release notes, or a concise product update.
test-plan
Produce a focused test plan for a change. Use when the user asks how to test a feature, what cases to cover, or for a QA checklist before shipping.
workspace-digest
Summarize the files saved in this assistant's shared workspace. Use when the user asks what is in their workspace, for a file inventory, or a digest of saved work.
debug-plan
Create a systematic debugging plan for a bug report. Use when the user asks how to investigate a failure, regression, or unexpected behavior.
pirate-voice
Rewrite or answer in a playful pirate voice. Use when the user asks for pirate tone, nautical phrasing, or says to talk like a pirate.