Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add comisai/comis --skill skill-creatorgit clone --depth 1 https://github.com/comisai/comisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/comisai/comis/skill-creator)<a href="https://agentmods.dev/skills/comisai/comis/skill-creator"><img src="https://agentmods.dev/badge/skills/comisai/comis/skill-creator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/comisai/comis/skill-creator"><img src="https://agentmods.dev/badge/skills/comisai/comis/skill-creator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 4 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.03213 |
| Opus 5.5 | $0.00033 | $0.01285 |
| Sonnet 5.5 | $0.00016 | $0.00643 |
| Haiku 4.5 | $0.00008 | $0.00321 |
Grade A, and why
skill-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 326 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Creator
Create, validate, and iterate on Comis prompt skills.
How Skills Work
Skills are Markdown instruction files that extend what the agent can do. When a user sends a message, the agent scans available skill descriptions and, if one matches, reads its SKILL.md and follows the instructions step by step. Skills are the primary way to teach the agent new capabilities without changing code.
Skills are hot-reloaded -- save a file and it's available immediately, no restart needed.
Core Principles
The context window is a public good
Skills share the context window with the system prompt, conversation history, other skills' metadata, and the user's request. Challenge each piece of information: "Does the agent really need this?" and "Does this paragraph justify its token cost?" Default assumption: the agent is already very smart -- only add context it doesn't already have. Prefer concise examples over verbose explanations.
Set appropriate degrees of freedom
Match the level of specificity to the task's fragility:
- High freedom (text-based instructions): Multiple approaches are valid, decisions depend on context. Like an open field -- many routes work.
- Medium freedom (pseudocode or parameterized scripts): A preferred pattern exists but some variation is acceptable.
- Low freedom (specific scripts, exact sequences): Operations are fragile, consistency is critical. Like a narrow bridge -- guardrails needed.
What NOT to include
A skill should only contain files that directly support its function. Do not create:
- README.md, CHANGELOG.md, INSTALLATION_GUIDE.md, or any auxiliary documentation
- User-facing docs about the process that went into creating the skill
- Setup/testing procedures (those belong in the iteration loop, not the skill)
Private vs Shared Skills
Skills can live in two places. Default to private unless the user explicitly asks for a shared skill.
Private skills (default)
Created in the agent's own workspace under skills/.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 326 lines · 82 tokens per session scan A c94442f24983
skill-creator is a skill published in the GitHub repository comisai/comis (5 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 82 tokens to every session and 3,213 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
takt
A workflow engine that runs a task through a sequence of steps defined in a YAML file, using separate coding agents for the work.
pandic-office
Convert Markdown to PDF (or DOCX/EPUB/HTML) using the pandoc CLI. Use when asked to produce a PDF report, brief, summary, or any document where the input is Markdown and the output should be a polished, paginated file.
tmux
Manage long-running shell sessions with tmux — start a detached session, run a long task, reattach later, capture output. Use when a task takes longer than a single tool call (build, test, log tail).
skill-creator
Generates Anthropic Skills with complete workflow including GitHub PR creation and local download verification.
codebase-context-extractor
This skill provides a comprehensive context extraction system for large codebases. It intelligently analyzes code structure, dependencies, and relationships to extract relevant context for understanding, debugging, or modifying code.
dd-synthesis
Synthesize findings from multiple specialist agents into a coherent investment recommendation. Use when combining reports from 9+ specialist agents into a single decision document.