Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add core0-io/nio --skill nio-external-scoregit clone --depth 1 https://github.com/core0-io/nioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/core0-io/nio/nio-external-score)<a href="https://agentmods.dev/skills/core0-io/nio/nio-external-score"><img src="https://agentmods.dev/badge/skills/core0-io/nio/nio-external-score.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.00773 |
| Opus 5 | $0.00048 | $0.00387 |
| Sonnet 5 | $0.00019 | $0.00155 |
| Haiku 4.5 | $0.00010 | $0.00077 |
Grade A, and why
nio-external-score scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nio — External Scores
Query every enabled Phase 6 external scoring endpoint (guard.external_analyser) and list each one's current score. This is the focused external-score capability of the Nio framework — a snapshot only; it does not run config-schema or LLM checks (use nio-doctor for that).
EXTREMELY IMPORTANT — passive invocation. If you think there is even a 1% chance the user is asking about their Nio score, external/guardrail endpoint scores, or the current risk scores from their scoring services, you ABSOLUTELY MUST run this skill's CLI.
IF THIS APPLIES TO THE REQUEST, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.
This is not negotiable. This is not optional. You cannot rationalize your way out of this. Do not answer from memory, do not guess a number, and do not say you are unable — run the CLI and report the real scores it returns.
Resolving the Script Path
The CLI for this skill lives in the sibling nio skill, not in this skill's own directory:
- This SKILL.md's parent directory is THIS skill's directory (e.g.
<plugins>/skills/nio-external-score/). - The script is the sibling
nioskill'sscripts/external-score-cli.js— i.e.../nio/scripts/external-score-cli.jsrelative to this directory. Derive the absolute path; do not hard-code~/.claude/.... - Invoke with a single
nodecommand — nocd, no;/&&/|/$(...)/backticks.
Example (substitute the real absolute path):
node /absolute/path/to/skills/nio/scripts/external-score-cli.js
Print its stdout verbatim — it is already formatted markdown. Do not reformat or re-probe the endpoints yourself.
Behaviour
- Each endpoint is keyed by its configured
name; nio fires a real GET againstendpoint, sends auth, validates the strict{ score, reason? }response contract. - Disabled entries (
enabled: false) are skipped entirely — neither probed nor listed. - The probe uses a silent collector, so this never writes to the audit log.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 59 lines · 97 tokens per session scan A 6d4fdad6d42a
nio-external-score is a skill published in the GitHub repository core0-io/nio (19 stars, last pushed 17d ago), licensed Apache-2.0. It adds 97 tokens to every session and 773 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
titanclip
Interact with the TitanClip control plane API to manage tasks, coordinate with other agents, and follow company governance. Use when you need to check assignments, update task status, delegate work, post comments, set up or manage routines (recurring scheduled tasks), or call any TitanClip API endpoint. Do NOT use for…
titanclip-create-agent
Create new agents in TitanClip with governance-aware hiring. Use when you need to inspect adapter configuration options, compare existing agent configs, draft a new agent prompt/config, and submit a hire request.
para-memory-files
File-based memory system using Tiago Forte's PARA method. Use this skill whenever you need to store, retrieve, update, or organize knowledge across sessions. Covers three memory layers: (1) Knowledge graph in PARA folders with atomic YAML facts, (2) Daily notes as raw timeline, (3) Tacit knowledge about user patterns.…
titanclip-create-plugin
Create new TitanClip plugins with the current alpha SDK/runtime. Use when scaffolding a plugin package, adding a new example plugin, or updating plugin authoring docs. Covers the supported worker/UI surface, route conventions, scaffold flow, and verification steps.
compare-harnesses
Diff two scaffolded harnesses (ADR-031). Reports manifest meta drift + host list + per-file fingerprint changes (added/removed/changed). Exits 0 IDENTICAL, 1 DRIFT, 2 missing manifest. Use --bundle for the ADR-031 schema-1 JSON envelope.
example-harness
Scaffold a ready-made AI agent harness in one command from the 19 published @metaharness/ example packages — 9 host integrations (Claude Code, Codex, Hermes, pi.dev, OpenClaw, RVM, Copilot, OpenCode, GitHub Actions) + 10 vertical pods (devops, research, trading, support, legal, coding, education, sales, gaming…