Borrowing it
Nothing to install: this file belongs to CelestoAI/SmolVM. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/CelestoAI/SmolVM/main/.agents/skills/readme-guidelines/SKILL.mdgit clone --depth 1 https://github.com/CelestoAI/SmolVMWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/celestoai/smolvm/readme-guidelines)<a href="https://agentmods.dev/skills/celestoai/smolvm/readme-guidelines"><img src="https://agentmods.dev/badge/skills/celestoai/smolvm/readme-guidelines.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00698 |
| Opus 5 | $0.00026 | $0.00349 |
| Sonnet 5 | $0.00010 | $0.00140 |
| Haiku 4.5 | $0.00005 | $0.00070 |
Grade A, and why
readme-guidelines scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
vm.run("curl $API_KEY") How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
README Guidelines
Review or write README content following these principles. The goal is easy onboarding for both newcomers and advanced users.
Core Principles
1. Progressive disclosure of complexity
Structure content so readers can stop at any point and still have a working mental model. Each section should be usable on its own:
- Lead with the simplest outcome (one-liner, quickstart)
- Add detail in subsequent sections
- Advanced topics (integrations, internals, performance) come last
- Never require reading ahead to understand what's in front of you
2. One concept per code example
Each code block should demonstrate exactly one idea. If a snippet requires the reader to understand two or more new things simultaneously, split it.
Wrong — introduces sandbox creation AND environment variables at the same time:
with SmolVM(env={"API_KEY": "secret"}) as vm:
vm.run("curl $API_KEY")
Right — teaches sandbox creation first, env vars in a separate example:
with SmolVM() as vm:
vm.run("echo 'hello'")
3. Jargon-free language first, depth second
Explain every concept as if talking to a first-year CS student before using technical terms. Then go deeper if the reader needs it.
- Bad: "SSH host keys are accepted on first connection via TOFU"
- Good: "SmolVM automatically trusts new sandboxes on first connection to keep setup simple. (This is called trust-on-first-use, or TOFU — the same approach your browser uses for new websites.)"
4. Introduce before you use
Never use a value, flag, or identifier in a code block without explaining where it comes from. If a command prints a session_id, show that command before any command that takes session_id as input.
Review Checklist
When reviewing a README, check each section against these rules:
- Tagline: does it describe a single, concrete outcome?
- Intro paragraph: can a newcomer understand it without prior context?
- Quickstart: does it follow install → configure → first run, in that order?
- Each code block: does it introduce exactly one new concept?
- Each new identifier (
<session_id>,<vm_id>): is it introduced before it's used? - Jargon: is every technical term explained in plain language on first use?
- Sections: does complexity increase monotonically top-to-bottom?
- Examples table: are entries grouped by audience (getting started vs. advanced)?
- Footer: does it duplicate links that already appear at the top?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 72 lines · 52 tokens per session scan A 054c8805e9f2
readme-guidelines is a skill published in the GitHub repository CelestoAI/SmolVM (882 stars, last pushed today), licensed Apache-2.0. It adds 52 tokens to every session and 698 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ai-deploy
Deploy a generated project (one process or several) to agent-sandboxes with scale-to-zero: idle sandboxes pause and auto-resume (process restarted) on the next HTTP request. Use when asked to deploy, host, or preview generated code through the sandbox platform.
e2b
Core E2B SDK knowledge — correct imports, namespacing, terminology, and API patterns. Activates automatically when working with E2B sandboxes, templates, or code execution.
workflow-builder
Generates Python workflow files using the Operator workflow DSL. Knows all available patterns (classify-and-act, fan-out-and-synthesize, adversarial-verify, generate-and-filter, tournament, loop-until-done) and produces ready-to-run .py files saved to the workflows directory.
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
browser_harness
../../SKILL.md.
unbrowse
One-call web access for agents with cache-first API replay and browser capture on misses. Unbrowse passively learns first-party route DAGs while browsing, independently validates replay, and keeps remote sharing consented and fail-closed. Prefer it over WebFetch, curl, and browser loops.