Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-csharpgit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-csharp)<a href="https://agentmods.dev/skills/cosmix/loom/loom-csharp"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-csharp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmix/loom/loom-csharp"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-csharp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.07221 |
| Opus 5.5 | $0.00006 | $0.02888 |
| Sonnet 5.5 | $0.00003 | $0.01444 |
| Haiku 4.5 | $0.00002 | $0.00722 |
Grade A, and why
loom-csharp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 416 lines — stays where its author put it; the contents beside it link to each section on GitHub.
C# Language Expertise
Overview
Idiomatic, production-quality C# on current .NET (.NET 8 and .NET 10 are the LTS releases; C# 12 ships with .NET 8, C# 14 with .NET 10). Assumes competence with the language. The value is in what compiles cleanly and still fails: nullable annotations that do not hold at runtime, sync-over-async deadlocks, deferred LINQ queries that run twice or on the client, DI lifetime mismatches, and test filters that select nothing.
Tooling
The dotnet CLI is the build tool, package manager, test driver and formatter front end. Keep the repository's SDK pin (global.json), solution layout and package management style.
| Task | Command |
|---|---|
| New solution and projects | dotnet new sln -n Spool, dotnet new classlib -o src/Spool, dotnet new xunit -o tests/Spool.Tests |
| Wire them together | dotnet sln add src/Spool/Spool.csproj, dotnet add tests/Spool.Tests/Spool.Tests.csproj reference src/Spool/Spool.csproj |
| Add a package | dotnet add src/Spool/Spool.csproj package Polly (never hand-edit PackageReference) |
| Build / test | dotnet build, dotnet test (restores and builds first) |
| Format | dotnet format (whitespace, code style and analyzer fixes driven by .editorconfig) |
| Audit dependencies | dotnet list package --vulnerable --include-transitive |
| Local tools | dotnet tool restore (versions pinned in .config/dotnet-tools.json) |
| Ignore build output | dotnet new gitignore (covers bin/ and obj/) |
Shared settings go in Directory.Build.props at the repository root; every project below it inherits them:
<Project>
<PropertyGroup>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<AnalysisLevel>latest-recommended</AnalysisLevel>
<EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
<RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>
</Project>
- Central Package Management:
Directory.Packages.propswith<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>holds everyPackageVersion; project files carry versionlessPackageReferences, so every project in the solution resolves the same version of a package. - NuGet audit runs during restore and reports known-vulnerable packages as
NU1901–NU1904warnings; withTreatWarningsAsErrorsthey fail the build. CI restores withdotnet restore --locked-modeso a driftedpackages.lock.jsonfails. dotnet formatapplies.editorconfigrules; some repositories use CSharpier for layout instead. Follow what the repository has.EnforceCodeStyleInBuildmakes IDE style rules (IDExxxx) build diagnostics, so the build and the IDE agree.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 416 lines · 16 tokens per session scan A 63a90e1e9476
loom-csharp is a skill published in the GitHub repository cosmix/loom (64 stars, last pushed yesterday), licensed MIT. It adds 16 tokens to every session and 7,221 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.
Other skills, from other repositories
idiomatic-go
Apply Go community idioms for API and package design, error and concurrency patterns, naming (initialisms, stutter, receivers), generics vs interfaces, and Go code review — including PR or diff review, questions about "the Go way", pointer vs value receivers, channels vs mutexes, and building Go language tooling…
go-documentation
Write idiomatic Go doc comments that render correctly on pkg.go.dev — package comments, doc.go, exported-symbol comments, testable Example functions, deprecation notices — and publish or debug modules on pkg.go.dev (pkgsite, the module proxy). Use when writing or reviewing Go documentation, or when a developer used to…
csharp-source-generator
Use when writing, reviewing, debugging, testing, or packaging C# source generators (Roslyn IIncrementalGenerator): pipeline caching and performance, marker attributes, diagnostics, snapshot or cacheability tests, analyzer NuGet packaging, MSBuild/analyzer config options, and interceptors. Also use when the user…
agent-framework-builder-dotnet
Use this skill when building, modifying, reviewing, evaluating, integrating, or hosting .NET (C#) applications with Microsoft Agent Framework. Use it for Agent Framework agents, harness agents, workflows, orchestrations, declarative definitions, tools, sessions, middleware, evaluation, observability, integrations, or…
build-and-test
How to build and test .NET projects in the Agent Framework repository. Use this when verifying or testing changes.
verify-dotnet-samples
How to build, run and verify the .NET sample projects in the Agent Framework repository. Use this when a user wants to verify that the samples still function as expected.