ext-develop

ext-develop is a skill for Claude Code, Codex from clacky-ai/openclacky. It costs 75 tokens per session (2,851 once invoked), scanned A, original, MIT.

A development guide for building OpenClacky extensions, which add panels, APIs, skills, agents, or messaging connections to OpenClacky.

In plain words
What is it for?
Use it to scaffold, edit, verify, hot-reload, publish, or unpublish an OpenClacky extension.
Why use it?
It gives one workflow for creating an extension, checking why it does not load or appear, and preparing it for release.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: agent in frontmatter.

Good fit Use it to scaffold, edit, verify, hot-reload, publish, or unpublish an OpenClacky extension.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/clacky-ai/openclacky/ext-develop
About the project

OpenClacky is an open-source AI coding agent that uses OpenAI-compatible models to perform tasks through tools and subagents. It is intended for developers who want an agent with flexible model choice and lower token usage. The catalogue skills and agents extend its workflows and capabilities.

clacky-ai/openclacky · 1,208 stars · on GitHub · openclacky.com

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add clacky-ai/openclacky --skill ext-develop
Clone the repo
git clone --depth 1 https://github.com/clacky-ai/openclacky

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ext-develop

README.md
[![agentmods](https://agentmods.dev/badge/skills/clacky-ai/openclacky/ext-develop/github.svg)](https://agentmods.dev/skills/clacky-ai/openclacky/ext-develop)
Your own site
<a href="https://agentmods.dev/skills/clacky-ai/openclacky/ext-develop"><img src="https://agentmods.dev/badge/skills/clacky-ai/openclacky/ext-develop/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ext-develop

Your own site · 80×15
<a href="https://agentmods.dev/skills/clacky-ai/openclacky/ext-develop"><img src="https://agentmods.dev/badge/skills/clacky-ai/openclacky/ext-develop.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 75 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,851 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Excessive Agency · line 52
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
  • medium Excessive Agency · line 94
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
  • medium Excessive Agency · line 145
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00075 $0.02851
Opus 5.5 $0.00030 $0.01140
Sonnet 5.5 $0.00015 $0.00570
Haiku 4.5 $0.00007 $0.00285

Measured 24d ago against content hash 7576610e953e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ext-develop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

lib/clacky/default_extensions/ext-studio/skills/ext-develop/SKILL.md · 196 lines

How it starts

The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Extension Development

Use this skill to guide the workflow, not as a second API manual. The online references below own the detailed contracts, examples, and reload behavior. The local engineering checks below remain mandatory even when those references cannot be fetched.

Before designing or editing

  1. Identify what the user wants and the smallest capability set that can provide it. Check existing host services and shared panels before building a replacement.
  2. For behavior-only discussion, apply Engineering checks without enumerating APIs. Before specifying or implementing an interface, choose its one matching capability reference below; read the overview when container/scaffold/reload behavior is relevant. Reuse verified text still in context. For a named interface, obey the system prompt's strict lookup budget and stop as unverified when it is exhausted. Use the article's contract/examples, not the documentation site's navigation, styles, or scripts. If the user declined a fallback, request only the missing source and never ask again.
  3. Confirm the proposed behavior, affected files, and visible result with the user before scaffolding or editing. Do not publish, restart, or add privileged behavior merely because implementation was approved.

Documentation fallback

  1. Fetch the relevant official URL directly; a web search is not required. For truncated output, read the returned temp_file for the needed section. For HTML pages, web_fetch saves extracted text with whitespace collapsed, not original HTML: line-based reading may still return one long line. One targeted text extraction is enough to check a detail. Do not write helper scripts or try to reconstruct code formatting from that text; lost newlines can change the meaning of code comments and examples. A no-file-change task includes temporary files such as /tmp/*.py: only read the tool-returned cache, do not create a script or reformatted copy elsewhere.
  2. If the needed contract is still missing, truncated, or ambiguous, stop this lookup. Report it as unverified; no match on a page does not prove the method or its namespace absent, private, or unsupported. Do not inventory other APIs to infer an answer. Do not retry extraction or probe other extensions/the running host to fill the gap. Ask permission to open the official documentation in a new browser tab. If already authorized for this task's documentation lookup, do not ask again for each page.
  3. After consent, use the available browser tool to read only the relevant official documentation. Do not navigate, inspect, or close unrelated tabs. Read beyond truncated snapshots as needed; opening a page alone does not verify its contents. If browser setup is required, ask whether the user wants to use browser-setup; never enable it silently or bypass a disabled browser. If the tool is unavailable, do not invent another browser control mechanism or install one without approval.
  4. If the user declines or the browser cannot retrieve the reference, ask the user to supply the documentation or designate a separate source checkout matching the running version and permit read-only inspection. Do not search installed OpenClacky gem source. Reading a checkout does not authorize modifying it to make an extension work.
  5. If still blocked, end with only Unverified detail, Reference checked, and Evidence or permission needed next. For example: "I could not verify this method from this page; please provide its source." Do not turn that into "the object does not exist" followed by a disclaimer. Clarifying the user's goal may continue, but implementation against that contract must wait. Resolve version differences before relying on a contract; version metadata is allowed, installed implementation source is not.

Read the full file on GitHub · 196 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 24d ago Changed · +2 lines 7576610e953e
  2. 1mo ago Changed · -398 lines b6e62795029a
  3. 1mo ago First seen · 592 lines · 75 tokens per session scan A 113135ad2e66

Subscribe to this mod's changes

ext-develop is a skill published in the GitHub repository clacky-ai/openclacky (1,208 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 2,851 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

hive.chart-creation-foundations

Required reading whenever any chart tool is available. Teaches the one-tool embedding contract (call chartrender → live chart appears in chat AND a downloadable PNG lands in the queen session dir), the ECharts (data viz) vs Mermaid (structural diagrams) decision, the BI/financial-grade aesthetic baseline (no…

aden-hive/hive · 133 tokens

browser-edge-cases

SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.

aden-hive/hive · 40 tokens

session-investigator

Investigate fast-agent session and history files to diagnose issues. Use when a session ended unexpectedly, when debugging tool loops, when correlating sub-agent traces with main sessions, or when analyzing conversation flow and timing. Covers session.json metadata, history JSON format, message structure, tool…

evalstate/fast-agent · 68 tokens

officecli-word-form

Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…

iOfficeAI/OfficeCLI · 224 tokens

windbg-user-heap-corruption-investigation

Use when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel pool corruption or ordinary OOM.

microsoft/win-dev-skills · 46 tokens

skill-creator

Generates Anthropic Skills with complete workflow including GitHub PR creation and local download verification.

lofcz/LLMTornado · 22 tokens