Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CodeAlive-AI/ai-driven-development --skill skills-managementgit clone --depth 1 https://github.com/CodeAlive-AI/ai-driven-developmentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/codealive-ai/ai-driven-development/skills-management)<a href="https://agentmods.dev/skills/codealive-ai/ai-driven-development/skills-management"><img src="https://agentmods.dev/badge/skills/codealive-ai/ai-driven-development/skills-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/codealive-ai/ai-driven-development/skills-management"><img src="https://agentmods.dev/badge/skills/codealive-ai/ai-driven-development/skills-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 40 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 3 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Prompt Injection · line 105 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Rogue Agent · line 137 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Rogue Agent · line 140 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Excessive Agency · line 171 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- medium MCP Rug Pull · line 41 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 43 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 44 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 45 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 46 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 47 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 125 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 127 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 261 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 266 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 267 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 268 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 283 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 284 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 290 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.06008 |
| Opus 5.5 | $0.00060 | $0.02403 |
| Sonnet 5.5 | $0.00030 | $0.01202 |
| Haiku 4.5 | $0.00015 | $0.00601 |
Grade A, and why
skills-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 483 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skills Manager
Quick Reference
| Task | Command |
|---|---|
| List all | python3 scripts/list_skills.py |
| List by scope | python3 scripts/list_skills.py -s user or -s project |
| Show details | python3 scripts/show_skill.py <name> |
| Review skill | python3 scripts/review_skill.py <name> |
| Delete | python3 scripts/delete_skill.py <name> |
| Delete from agents | python3 scripts/delete_skill.py <name> --all-agents --force |
| Move to user | python3 scripts/move_skill.py <name> user |
| Move to project | python3 scripts/move_skill.py <name> project |
| Audit duplicate names | python3 scripts/audit_skill_duplicates.py |
| Preflight install | python3 scripts/audit_skill_duplicates.py --candidate /path/to/skill --fail-on-conflict |
| Create new | Use /skill-creator |
| Optimize & Iterate (SkillOpt-style) | |
| Plan optimisation | python3 scripts/optimize_skill.py <name> --tasks tasks.jsonl --dry-run |
| Run optimisation | python3 scripts/optimize_skill.py <name> --tasks tasks.jsonl --output-dir runs/r1 |
| Log a manual edit | python3 scripts/log_skill_edit.py <name> --reason "..." --snapshot |
| List recent edits | python3 scripts/log_skill_edit.py <name> --list --since 7d |
| Diff vs last snapshot | python3 scripts/diff_skill_versions.py <name> --log --format stats |
| Diff between commits | python3 scripts/diff_skill_versions.py <name> --git HEAD~3 HEAD |
| Trigger test | python3 scripts/trigger_test.py <name> --cases cases.yaml |
| Generate trigger cases | python3 scripts/trigger_test.py <name> --generate > cases.yaml |
| Transfer test | python3 scripts/transfer_test.py <name> --all |
| Aggregate runs | python3 scripts/aggregate_runs.py runs/* |
| Compare runs | python3 scripts/aggregate_runs.py runs/r1 runs/r2 --compare |
| Assertion-graded run | python3 scripts/optimize_skill.py <name> --tasks tasks.jsonl --verifier assertions |
| Multi-run variance | python3 scripts/optimize_skill.py <name> --tasks tasks.jsonl --runs-per-task 3 |
| Blind A/B compare | python3 scripts/blind_comparator.py --skill-a runs/r1/initial_skill.md --skill-b runs/r1/best_skill.md --tasks tasks.jsonl --output-dir cmp/ |
| HTML viewer | python3 scripts/eval_viewer.py runs/r1 |
| Compare two runs (HTML) | python3 scripts/eval_viewer.py runs/r1 runs/r2 --compare |
| Discovery & Install | |
| Find skills | npx skills find [query] |
| Review remote skills | Fetch skills.sh pages, assess using assessment framework |
| List ecosystem skills | npx skills list or npx skills ls |
| Install from GitHub | npx skills add <owner/repo@skill> -g -y |
| Remove ecosystem skill | npx skills remove <name> -g -y or npx skills rm |
| Inspect installed versions | Read lock metadata and upstream state; do not assume npx skills check is read-only |
| Update all | npx skills update |
| Browse online | skills.sh |
| Multi-Agent | |
| Detect agents | python3 scripts/detect_agents.py |
| List agent skills | python3 scripts/list_agent_skills.py --agent cursor |
| Install to agent | python3 scripts/install_skill.py /path --agent cursor |
| Copy between agents | python3 scripts/copy_skill.py <name> --from claude-code --to cursor |
| Move between agents | python3 scripts/move_skill_agent.py <name> --from claude-code --to cursor |
What ships with it
48 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- prompts/analyst_error.md 1.9 KB
- prompts/analyst_success.md 1.6 KB
- prompts/blind_comparator.md 1.1 KB
- prompts/grader.md 1.3 KB
- prompts/merge_failure.md 1.4 KB
- prompts/merge_final.md 1.3 KB
- prompts/merge_success.md 1.1 KB
- prompts/meta_skill.md 1.7 KB
- prompts/ranking.md 1008 B
- prompts/slow_update.md 2.2 KB
- references/01-introduction.md 2.1 KB
- references/02-fundamentals.md 2.9 KB
- references/03-planning-and-design.md 8.6 KB
- references/04-testing-and-iteration.md 3.7 KB
- references/05-distribution-and-sharing.md 3.6 KB
- references/06-patterns-and-troubleshooting.md 10 KB
- references/07-resources-and-references.md 1.2 KB
- references/opencode-skills.md 6.3 KB
- references/optimization-artifacts-schemas.md 19 KB
- references/optimization-grading-checklist.md 14 KB
- references/ref-a-quick-checklist.md 1.0 KB
- references/ref-b-yaml-frontmatter.md 5.6 KB
- references/ref-c-complete-skill-examples.md 519 B
- references/remote-skill-assessment.md 4.6 KB
- references/skill-deduplication.md 7.5 KB
- references/skill-optimization.md 8.1 KB
- scripts/agents.py 12 KB runs code
- scripts/aggregate_runs.py 20 KB runs code
- scripts/audit_skill_duplicates.py 12 KB runs code
- scripts/blind_comparator.py 22 KB runs code
- scripts/copy_skill.py 5.0 KB runs code
- scripts/delete_skill.py 8.6 KB runs code
- scripts/detect_agents.py 3.3 KB runs code
- scripts/diff_skill_versions.py 12 KB runs code
- scripts/eval_viewer.py 40 KB runs code
- scripts/install_skill.py 9.0 KB runs code
- scripts/list_agent_skills.py 6.6 KB runs code
- scripts/list_skills.py 4.5 KB runs code
- scripts/log_skill_edit.py 11 KB runs code
- scripts/move_skill_agent.py 5.2 KB runs code
- scripts/move_skill.py 3.1 KB runs code
- scripts/optimize_skill.py 54 KB runs code
- scripts/review_skill.py 28 KB runs code
- scripts/show_skill.py 7.1 KB runs code
- scripts/transfer_test.py 11 KB runs code
- scripts/trigger_test.py 20 KB runs code
- tests/test_audit_skill_duplicates.py 4.2 KB runs code
- tests/test_install_skill.py 1.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed b749a39b8f80
- 2mo ago First seen · 483 lines · 151 tokens per session scan A 9738bf5cda9e
skills-management is a skill published in the GitHub repository CodeAlive-AI/ai-driven-development (168 stars, last pushed 2d ago), licensed MIT. It adds 151 tokens to every session and 6,008 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agenttrace-session-audit
Audit local AI coding-agent sessions with agenttrace for cost, tool failures, latency, anomalies, health, diffs, and CI gates.
grok-cli
Delegate bounded tasks to Grok Build from a supervising agent such as Codex. Use when the user asks Grok to investigate, review, implement, or provide another perspective, or when a distinct coding agent would materially help. Includes a background ACP client for progress, follow-up prompts, permissions, and…
marketing-copy
Write outbound promotional copy for a product or project: launch and update posts for community platforms and social media, store page descriptions and short blurbs, landing page headlines and calls to action, press-style announcements, and the naming of a product for another language or market. Covers what may be…
intuitive-refactor
Execute a selected cleanup seam after its target and scope are known; use reduce-entropy for discovery.
intuitive-preflight
Turn a vague task or plan into an execution contract with scope, non-goals, acceptance, verification, and route.
intuitive-squash
Safely rewrite noisy local history into reviewable commits, with aggressive or moderate plan choices, when the user explicitly asks to squash.