Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/comisai/comis/skill-creatornpx skills add comisai/comis --skill skill-creatorgit clone --depth 1 https://github.com/comisai/comisWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.03213 |
| Opus 5 | $0.00041 | $0.01606 |
| Sonnet 5 | $0.00016 | $0.00643 |
| Haiku 4.5 | $0.00008 | $0.00321 |
Grade A, and why
skill-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 326 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Creator
Create, validate, and iterate on Comis prompt skills.
How Skills Work
Skills are Markdown instruction files that extend what the agent can do. When a user sends a message, the agent scans available skill descriptions and, if one matches, reads its SKILL.md and follows the instructions step by step. Skills are the primary way to teach the agent new capabilities without changing code.
Skills are hot-reloaded -- save a file and it's available immediately, no restart needed.
Core Principles
The context window is a public good
Skills share the context window with the system prompt, conversation history, other skills' metadata, and the user's request. Challenge each piece of information: "Does the agent really need this?" and "Does this paragraph justify its token cost?" Default assumption: the agent is already very smart -- only add context it doesn't already have. Prefer concise examples over verbose explanations.
Set appropriate degrees of freedom
Match the level of specificity to the task's fragility:
- High freedom (text-based instructions): Multiple approaches are valid, decisions depend on context. Like an open field -- many routes work.
- Medium freedom (pseudocode or parameterized scripts): A preferred pattern exists but some variation is acceptable.
- Low freedom (specific scripts, exact sequences): Operations are fragile, consistency is critical. Like a narrow bridge -- guardrails needed.
What NOT to include
A skill should only contain files that directly support its function. Do not create:
- README.md, CHANGELOG.md, INSTALLATION_GUIDE.md, or any auxiliary documentation
- User-facing docs about the process that went into creating the skill
- Setup/testing procedures (those belong in the iteration loop, not the skill)
Private vs Shared Skills
Skills can live in two places. Default to private unless the user explicitly asks for a shared skill.
Private skills (default)
Created in the agent's own workspace under skills/.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 326 lines · 82 tokens per session scan A c94442f24983
skill-creator is a skill published in the GitHub repository comisai/comis (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 82 tokens to every session and 3,213 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
llmtornado-tutorial-generator
Generates comprehensive code tutorials on LlmTornado API formatted for Medium publication with examples, explanations, and best practices.
org-sync
Use when the CEO wants an organization-wide sync across PuPu's agent teams — running each org's internal sync, then a cross-org sync where departments challenge each other, converging into one decision list. Triggers: "跑一次 org sync", "全局同步", "组织盘点", "/org-sync", "各部门现在什么情况", "有什么要我拍板的".
release-feature-audit
Use when a new PuPu feature finishes implementation and needs its consistency audit before its ticket is marked done — "audit #123", "审计这个功能", "这个 feature 过一遍检查" — or when release-close-sprint roll-call finds a new feature that was never audited. Also covers standalone i18n checks ("漏翻了吗", "检查 i18n"), which used to be…
gitnexus-impact-analysis
Use when the user wants to know what will break if they change something, or needs safety analysis before editing code. Examples: "Is it safe to change X?", "What depends on this?", "What will break?".
growth-analyst
Use when analyzing PuPu's open-source growth or health for the founder — GitHub traffic, downloads/installs, releases, community, or contributor activity — or when producing a growth report or weekly COO report. Repo is haoxiang-xu/PuPu. Triggers: "how is PuPu growing?", "are people installing PuPu?", "which release…
test-api
Use when running QA / regression tests against PuPu, when verifying a code change actually works in the running app, or when reading PuPu UI/state without screenshotting manually. Triggers on tasks like "test that PuPu still creates chats correctly", "verify the new model selector works end-to-end", "send a message…