Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ChronoAIProject/NyxID --skill aevatar-service-publishergit clone --depth 1 https://github.com/ChronoAIProject/NyxIDWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chronoaiproject/nyxid/aevatar-service-publisher)<a href="https://agentmods.dev/skills/chronoaiproject/nyxid/aevatar-service-publisher"><img src="https://agentmods.dev/badge/skills/chronoaiproject/nyxid/aevatar-service-publisher/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chronoaiproject/nyxid/aevatar-service-publisher"><img src="https://agentmods.dev/badge/skills/chronoaiproject/nyxid/aevatar-service-publisher.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 287 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00213 | $0.05784 |
| Opus 5.5 | $0.00085 | $0.02314 |
| Sonnet 5.5 | $0.00043 | $0.01157 |
| Haiku 4.5 | $0.00021 | $0.00578 |
Grade A, and why
aevatar-service-publisher scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# token. A raw curl to the aevatar backend with ~/.nyxid/access_token resolves NO scope How it starts
The opening of the file, as written. The whole thing — 409 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish an Aevatar artifact as a (NyxID) service
You turn a member / team / workflow into an invocable service and verify whether it is
registered with NyxID as a brokered connector. Build the artifact first
(aevatar-team-builder). Then pick the path that matches what you have.
Bootstrap
# Drive aevatar THROUGH the NyxID broker: it injects your scope_id claim AND auto-refreshes your
# token. A raw curl to the aevatar backend with ~/.nyxid/access_token resolves NO scope
# (scopeResolved:false) and the stored token expires — it is not a usable path.
# Prerequisite once: the `aevatar` service must be connected — `nyxid service add aevatar`.
# NOTE: the aevatar backend requires `Content-Type: application/json` on writes (POST/PUT) —
# omit it and every write returns HTTP 415 Unsupported Media Type. The helper sets it on
# every call (harmless on bodyless GETs), so the POST/PUT examples below work as written.
aev() { nyxid proxy request aevatar "$@" -H 'Content-Type: application/json'; } # aev "<path>" [-m POST|PUT|DELETE] [-d '<json>'] [--stream]
scopeId=$(aev "api/studio/context" | jq -r .scopeId)
jqis only for convenience — any JSON reader works (replace| jq -r .scopeIdwith| python3 -c 'import sys,json;print(json.load(sys.stdin)["scopeId"])'). All calls go through the NyxID broker (nyxid proxy request aevatar), which injects your scope_id claim and auto-refreshes the token, so you never touch the aevatar backend or a stored token directly. On the streaming:streaminvoke, the SSEdata:frames interleave lifecycle frames (stepStarted/stepFinished/runFinished/stateSnapshot/usage, keyed by a top-level field) with raw observation frames (custom.name: aevatar.raw.observed) that carry the step output text — there is no flattypefield, so parse for those keys, notobj.type.
First, the honest constraint about NyxID registration
Registration to NyxID is automatic but host-gated. When a service deployment becomes active, the platform reconciles it to NyxID — only if the host has external exposure enabled and the service is in scope of that policy. You can drive publish + activation and read the result, but you cannot turn host exposure on from the client. So always verify (below) and report honestly: if no NyxID slug appears, the service is still usable in-scope, it just is not a NyxID-brokered connector.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 409 lines · 213 tokens per session scan A b30dfdcb2725
aevatar-service-publisher is a skill published in the GitHub repository ChronoAIProject/NyxID (41 stars, last pushed yesterday), licensed Apache-2.0. It adds 213 tokens to every session and 5,784 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
aevatar-service-publisher compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| aevatar-service-publisherChronoAIProject/NyxID | Skill | 41 | yesterday | Apache-2.0 | A | 213 | Claude Code |
| n8n-code-toolczlonkowski/n8n-mcp | Skill | 23k | yesterday | MIT | A | 221 | Claude Code, Codex |
| n8n-subworkflowsczlonkowski/n8n-mcp | Skill | 23k | yesterday | MIT | A | 121 | Claude Code, Codex |
| implementing-api-schema-validation-securityxalgorix/xalgorix | Skill | 1.3k | yesterday | Apache-2.0 | A | 35 | Claude Code, Codex |
| agentsecretsThe-17/agentsecrets | Skill | 196 | yesterday | MIT | A | 21 | Claude Code, Codex |
| sanity-singletonssanity-io/agent-toolkit | Skill | 197 | 10d ago | MIT | A | 90 | Claude Code |
| sanity-best-practicessanity-io/agent-toolkit | Skill | 197 | 10d ago | MIT | A | 177 | Claude Code |