Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/burin-labs/harn/write-developer-docsnpx skills add burin-labs/harn --skill write-developer-docsgit clone --depth 1 https://github.com/burin-labs/harnWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00015 |
| Opus 5 | $0.00000 | $0.00008 |
| Sonnet 5 | $0.00000 | $0.00003 |
| Haiku 4.5 | $0.00000 | $0.00002 |
Grade A, and why
write-developer-docs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
../../../.codex/skills/write-developer-docs/SKILL.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 1 lines · 0 tokens per session scan A 9e422bad6ef7
write-developer-docs is a skill published in the GitHub repository burin-labs/harn (20 stars, last pushed 2d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 15 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
translate
翻译技能。将用户提供的文本翻译为目标语言。默认在中文和英文之间互译：中文内容翻译为英文，英文内容翻译为中文。.
self-host-studio
Install and self-host deco Studio (the open-source control plane) on the user's own infrastructure. Use when the user wants to install, run, self-host, or deploy Studio locally (Docker, Rancher Desktop, kind, minikube) or on Kubernetes (managed or self-managed), or asks to "install Studio", "self-host decocms"…
add-mcp-tools
Guide for adding new MCP tools with consistent patterns for schemas, tool definitions, registry updates, and Better Auth integration.
slides
Create and edit presentation decks as single self-contained HTML files with a live, editable preview and print-to-PDF export. Use when the user wants slides, a deck, or a presentation.
brand
Create and maintain an org's brand as a folder the whole platform reads: colors, type, voice, logo and a deck theme. Use this whenever someone asks to "set up our brand", "make a brand kit", "apply our colors/fonts", or before producing branded artifacts (decks, pages, emails). One brand = one folder; everything that…
decocms-ui
Build or style React UI with the decocms product design system (@decocms/ui). Use when creating interfaces, pages, or components in a project that should look like decocms products, when the user mentions "design system", "@decocms/ui", "decocms style", or asks to make UI consistent with Studio. Covers installation…