Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add coreyhaines31/makerskills --skill domaingit clone --depth 1 https://github.com/coreyhaines31/makerskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/coreyhaines31/makerskills/domain)<a href="https://agentmods.dev/skills/coreyhaines31/makerskills/domain"><img src="https://agentmods.dev/badge/skills/coreyhaines31/makerskills/domain/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/coreyhaines31/makerskills/domain"><img src="https://agentmods.dev/badge/skills/coreyhaines31/makerskills/domain.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 141 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 152 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 153 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 154 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Data Exfiltration · line 186 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 354 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00232 | $0.06273 |
| Opus 5 | $0.00116 | $0.03136 |
| Sonnet 5 | $0.00046 | $0.01255 |
| Haiku 4.5 | $0.00023 | $0.00627 |
Grade A, and why
domain scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
code=$(curl -sL -o /dev/null -w "%{http_code}" -A "$UA" "https://rdap.org/domain/$domain") How it starts
The opening of the file, as written. The whole thing — 382 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/domain — Brainstorm + check available .com domains
Multi-tool workflow to find a great, affordable, available .com for a new project. Built on Laura Roeder's rule: work backwards from what's actually available — don't fall in love with a name first (source).
Defaults to .com only. Only deviate (.dev, .co, .io, .ai) if the project is dev-tooling-only or the user explicitly asks.
Step 0 — Environment checks
Verify these before proceeding (surface install commands if missing, don't try to install silently):
| Tool | Check | Install if missing |
|---|---|---|
| Vercel CLI | vercel whoami |
npm i -g vercel && vercel login |
| whois | which whois |
brew install whois (macOS) |
| Domainr API key | [ -n "$DOMAINR_API_KEY" ] |
Get free key at rapidapi.com/domainr/api/domainr, add to ~/.zshenv |
| Namecheap API | [ -n "$NAMECHEAP_API_KEY" ] && [ -n "$NAMECHEAP_API_USER" ] && [ -n "$NAMECHEAP_CLIENT_IP" ] |
Enable API at ap.www.namecheap.com/settings/tools/apiaccess/, add 3 env vars, whitelist your IP |
Domainr + Namecheap are optional — the workflow degrades gracefully without them (skips the corresponding cross-check steps).
Step 1 — Set the budget
Ask: what would you pay for a great .com on this project? Anchor defaults:
| Budget | What it buys |
|---|---|
| $0 | Only unregistered domains (rare for anything good) |
| $250–$1k | Aftermarket sweet spot (HugeDomains is the standout — Laura found "a ton of great .com's available for less than $1k") |
| $1k–$2k | Laura's Paperbell.com range — plenty of brandable options |
| $2k+ | Premium |
Filter all candidates to under-budget BEFORE falling in love.
Step 2 — Seed words for "branded" combos
Ask what the product does + the feeling/category. Brainstorm 20–40 candidate domains using these preferences (in order):
- Two real words mashed together ← preferred (Helpscout, RightMessage, ConvertKit, Paperbell, Mailchimp). Easy to spell, remember, google.
- Prefix/suffix the bare word — grab the .com when the bare word is taken or over budget. "I love word X, X.com is gone, what qualifier unlocks the .com?"
- Modern prefixes (B2B SaaS feel):
try(TryGamma, TryRoam),use(UseMotion, UseChalk),with(WithCove, WithFrame),join(JoinHomebase, JoinHonor) - Classic prefixes (still work):
get(GetMagic, GetResponse),go(GoCardless, GoFundMe),hey(HeyMarvin, HeyHenry),the(TheBrowserCompany, TheDyrt — editorial vibe) - Dated — avoid unless intentional:
my(MyFitnessPal),meet(MeetEdgar) - Suffixes:
+ly(Calendly, Grammarly — battle-tested but reads "2015 startup"),+ify(Spotify, Shopify — rare, hard to land authentically),+labs(AI/research positioning),+hq/+app(mostly informal) - Watch: trademark collision (
UseSlack.comis a brand violation even if registrable); popular bare words often havetry/use/get/joinvariants pre-grabbed by the same owner; longer URLs cost spelling-on-phone bandwidth - Full grid: if the user loves a bare word, generate all
try/use/with/join/get/go/hey/the + wordandword + ly/ify/labs/hq/appin one shot — ~15 variants
- Modern prefixes (B2B SaaS feel):
- One real word, slightly modified (Trello, Pinterest, Lyft) — fine.
- Made-up-sounds (Sunsama, Besedky) — only as fallback. Notoriously hard to remember.
- Common single-word objects (Clubhouse, Spoke, Blush, Finder) — AVOID. Ungoogleable, .com always taken, collides with other products.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 382 lines · 232 tokens per session scan A 5a08f9468770
domain is a skill published in the GitHub repository coreyhaines31/makerskills (795 stars, last pushed 4d ago), licensed MIT. It adds 232 tokens to every session and 6,273 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
service-desk
Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets…
session-cleanup
Identify stale and empty Claude Code sessions in the Agent Monitor and explain the cleanup endpoint (POST /api/settings/cleanup), always showing the exact list of what WOULD be removed before anything is deleted. Cleanup permanently deletes data, so this skill previews first and requires explicit user confirmation.…
suede-onboarding
Suede-affiliated onboarding and activation strategy for first-run sequencing, empty states, setup checklists, activation milestones, time to value, and retention-linked measurement. Use when users sign up but fail to reach first value or the product needs a new first-session flow. NOT FOR: registration optimization…
init-deep
Generates hierarchical context files (CLAUDE.md) throughout a project directory tree, providing AI agents with directory-specific knowledge for better code understanding. Use when setting up a new project for AI-assisted development.
freeze
Scope or freeze which files Claude can edit during debugging, a refactor, or review. Use when edits should stay in specific dirs, or for a read-only investigate lock. Backed by a sentinel + PreToolUse hook.
incoming-request-advisor
Decode an incoming message into a structured breakdown separating the literal ask from the job-to-be-done. Use when a loaded Slack ping, email, mandate, or escalation needs a reply.