Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-cgit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-c)<a href="https://agentmods.dev/skills/cosmix/loom/loom-c"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-c/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmix/loom/loom-c"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-c.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.05993 |
| Opus 5.5 | $0.00010 | $0.02397 |
| Sonnet 5.5 | $0.00005 | $0.01199 |
| Haiku 4.5 | $0.00003 | $0.00599 |
Grade A, and why
loom-c scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 400 lines — stays where its author put it; the contents beside it link to each section on GitHub.
C Language Expertise
Overview
Idiomatic, defensive C17 (C23 where the toolchain supports it): who owns each allocation, how failure is reported, which operations are undefined behaviour (UB), how buffers are bounded, and how the build, sanitizers and tests catch what the compiler cannot. Assumes the reader knows the language. The content is decision rules and the traps that survive review: malloc(n * size) overflow, realloc assigned back to its only pointer, strncpy leaving no terminator, signed overflow in a bounds check, a char passed to isalpha, a return value ignored.
Tooling
| Task | Command |
|---|---|
| Configure (CMake) | cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug |
| Build | cmake --build build |
| Test | ctest --test-dir build --output-on-failure |
| One test | ctest --test-dir build -R '^spool_rejects_symlink$' --output-on-failure |
| Static analysis | clang-tidy -p build src/*.c, cppcheck --enable=warning,style,performance --error-exitcode=1 src/ |
| Format | clang-format -i src/*.c include/*.h |
| Memory check | valgrind --leak-check=full --error-exitcode=1 ./build/tests/spool_test |
Keep the build system the repository already has. A new project uses CMake (3.20+) with presets, which also feeds clang-tidy through compile_commands.json.
cmake_minimum_required(VERSION 3.20)
project(spool LANGUAGES C)
set(CMAKE_C_STANDARD 17)
set(CMAKE_C_STANDARD_REQUIRED ON)
set(CMAKE_C_EXTENSIONS OFF)
set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
add_library(spool src/spool.c)
target_include_directories(spool PUBLIC include)
target_compile_options(spool PRIVATE -Wall -Wextra -Wpedantic -Wshadow -Wconversion -Wformat=2)
enable_testing()
add_executable(spool_test tests/spool_test.c)
target_link_libraries(spool_test PRIVATE spool)
add_test(NAME spool_appends_record COMMAND spool_test)
- Warnings:
-Wall -Wextra -Wpedantic -Wshadow -Wconversion -Wformat=2, and-Werrorin CI only (a new compiler release adds warnings and should not break a downstream build).-Wconversionis noisy at first and finds signed/unsigned and narrowing bugs. - Standard: pin
-std=c17(orc11) and turn GNU extensions off (CMAKE_C_EXTENSIONS OFF) unless the code needs them. C23 addsnullptr,bool/true/falseas keywords,constexpr,typeof,#embed,[[nodiscard]]and<stdckdint.h>; check the minimum GCC (13+) and Clang (18+) before relying on it. - Debug builds:
-O0 -g3; sanitized builds use-O1 -g -fno-omit-frame-pointer. Optimised builds are where UB bites, so run the tests under-O2too.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 400 lines · 25 tokens per session scan A e07138c82d15
loom-c is a skill published in the GitHub repository cosmix/loom (62 stars, last pushed today), licensed MIT. It adds 25 tokens to every session and 5,993 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-04.
Other skills, from other repositories
unit-test-parameterized
Provides parameterized testing patterns with JUnit 5, generates data-driven unit tests using @ParameterizedTest, @ValueSource, @CsvSource, @MethodSource. Creates tests that run the same logic with multiple input values. Use when writing data-driven Java tests, multiple test cases from single method, or boundary value…
unit-test-scheduled-async
Provides patterns for unit testing Spring @Scheduled and @Async methods using JUnit 5, CompletableFuture, Awaitility, and Mockito. Covers mocking task execution and timing, verifying execution counts, testing cron expressions, validating retry behavior, and simulating thread pool behavior. Use when testing background…
unit-test-mapper-converter
Provides patterns for unit testing mappers, converters, and bean mappings. Validates entity-to-DTO and model transformation logic in isolation. Generates executable mapping tests with MapStruct and custom converter test coverage. Use when writing mapping tests, converter tests, entity mapping tests, or ensuring…
unit-test-service-layer
Provides patterns for unit testing service layer with Mockito. Creates isolated tests that mock repository calls, verify method invocations, test exception scenarios, and stub external API responses. Use when testing service behaviors and business logic without database or external services.
rust-development
Idiomatisk Rust-utvikling med cargo, clippy, error handling, async/tokio, unsafe og testing.
zunit
Generate and run zunit tests for java-cli-app projects. Use when asked to create tests, write tests, add tests, or generate test files for a java-cli-app project. Triggers on "zunit", "write tests", "create tests", "add tests", "test this", "generate tests", or requests to test a java-cli-app application. Also trigger…