Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-cppgit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-cpp)<a href="https://agentmods.dev/skills/cosmix/loom/loom-cpp"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-cpp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmix/loom/loom-cpp"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-cpp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.07561 |
| Opus 5.5 | $0.00006 | $0.03024 |
| Sonnet 5.5 | $0.00003 | $0.01512 |
| Haiku 4.5 | $0.00002 | $0.00756 |
Grade A, and why
loom-cpp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 430 lines — stays where its author put it; the contents beside it link to each section on GitHub.
C++ Language Expertise
Overview
Idiomatic, production-quality C++20/23 for an engineer who already knows the language. The expensive C++ mistakes compile cleanly: dangling views and references, undefined behaviour the optimizer exploits, resources nobody owns, and CMake targets that leak flags into each other. This skill is decision rules and traps. Check a compiler's support table (cppreference "compiler support") before relying on a C++23 library feature.
Tooling
CMake describes the build, Ninja or Make runs it, CTest runs the tests. Keep the repository's generator, presets and package manager.
| Task | Command |
|---|---|
| Configure (out of source) | cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DCMAKE_EXPORT_COMPILE_COMMANDS=ON |
| Configure from a preset | cmake --preset debug (CMakePresets.json, checked in) |
| Build | cmake --build build -j |
| Test | ctest --test-dir build --output-on-failure -j 8 (--test-dir needs CMake 3.20+) |
| List registered tests | ctest --test-dir build -N |
| Format | clang-format -i <files>; CI: clang-format --dry-run --Werror <files> |
| Lint | run-clang-tidy -p build (reads compile_commands.json and .clang-tidy) |
| Add a dependency | vcpkg add port fmt (manifest mode, vcpkg.json); Conan 2: the recipe plus conan install . --build=missing |
- vcpkg (toolchain
-DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake) and Conan 2 (CMakeToolchaingenerator) both hand CMakefind_package(... CONFIG REQUIRED)targets.FetchContentdownloads sources at configure time and needs network access then, which sandboxed sessions may lack; fetch test frameworks through the package manager or the system. - clang-tidy: enable
bugprone-*,modernize-*,performance-*, a prunedcppcoreguidelines-*,misc-const-correctness; setWarningsAsErrors: '*'in.clang-tidyso findings fail the gate. It must see the build's flags, whichcompile_commands.jsonprovides. - A pip-installed
cmakeshim earlier onPATHcan shadow the real CMake suite (itsctestfails withModuleNotFoundError).command -v ctestshows which binary runs. - Multi-config generators (Visual Studio, Ninja Multi-Config) ignore
CMAKE_BUILD_TYPE: pass--config Debugtocmake --buildand-C Debugtoctest.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago First seen · 430 lines · 16 tokens per session scan A 2f44df3cc4b3
loom-cpp is a skill published in the GitHub repository cosmix/loom (62 stars, last pushed today), licensed MIT. It adds 16 tokens to every session and 7,561 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.
Other skills, from other repositories
add-rcpp-integration
Add Rcpp or RcppArmadillo integration to an R package for high-performance C++ code. Covers setup, writing C++ functions, RcppExports generation, testing compiled code, and debugging. Use when an R function is too slow and profiling confirms a bottleneck, when you need to interface with existing C/C++ libraries, or…
idiomatic-go
Apply Go community idioms for API and package design, error and concurrency patterns, naming (initialisms, stutter, receivers), generics vs interfaces, and Go code review — including PR or diff review, questions about "the Go way", pointer vs value receivers, channels vs mutexes, and building Go language tooling…
go-documentation
Write idiomatic Go doc comments that render correctly on pkg.go.dev — package comments, doc.go, exported-symbol comments, testable Example functions, deprecation notices — and publish or debug modules on pkg.go.dev (pkgsite, the module proxy). Use when writing or reviewing Go documentation, or when a developer used to…
zephyr-json
JSON serialization and deserialization in Zephyr RTOS using the descriptor-based JSON library. Use when encoding C structs to JSON strings, parsing JSON into C structs, working with nested objects or arrays, handling cloud/IoT protocols (MQTT, HTTP, CoAP payloads), or implementing REST APIs on embedded devices.
gdb
Debug and trace C/C++/Rust programs with the GNU Debugger (GDB) without blocking the agent. Use when you need to set tracepoints, inspect variables, or monitor a running process while staying responsive to the user.
authoring-java-sdk-tasks
Writes Airflow task logic in Java, Kotlin, or any JVM language using the Airflow Java SDK. Use when the user wants to implement Airflow tasks in Java/JVM, asks about @Builder.Dag/@Builder.Task/@Builder.XCom, the Task/BundleBuilder interfaces, reading connections/variables/XComs from Java, the JSON-to-Java type…