Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-event-drivengit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-event-driven)<a href="https://agentmods.dev/skills/cosmix/loom/loom-event-driven"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-event-driven/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cosmix/loom/loom-event-driven"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-event-driven.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.08235 |
| Opus 5.5 | $0.00012 | $0.03294 |
| Sonnet 5.5 | $0.00006 | $0.01647 |
| Haiku 4.5 | $0.00003 | $0.00823 |
Grade A, and why
loom-event-driven scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 536 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Event-Driven Architecture
Overview
Patterns for decoupling services via events instead of synchronous calls: message queues, pub/sub, event sourcing, CQRS, sagas, and streaming. Scope of THIS skill = the architecture and its distributed-systems traps (delivery semantics, ordering, outbox, schema evolution). For job-queue mechanics — worker pools, scheduling/cron, retry/backoff internals, generic DLQ plumbing — see loom-background-jobs; cross-reference rather than duplicate.
The one law that governs everything below: networked delivery is at-least-once; therefore every consumer must be idempotent. Read the Delivery Semantics section first — most EDA bugs are a violation of it.
Code samples are TypeScript for concreteness; the patterns are language-agnostic. Assume crypto.randomUUID(), a broker client, and a datastore are in scope.
Delivery Semantics — "Exactly-once" Is (Mostly) a Lie
Two-Generals: across an unreliable network you cannot guarantee a message is delivered exactly once. You get to pick a failure mode:
| Semantic | Mechanism | Failure mode | Use when |
|---|---|---|---|
| At-most-once | fire-and-forget, ack before processing | loses messages on crash | metrics/telemetry where loss is OK |
| At-least-once | ack after processing, redeliver on no-ack | duplicates on retry/redelivery | default for everything that matters |
| "Exactly-once" | at-least-once transport + idempotent consumer + dedup | none observable | any state-changing handler |
Exactly-once is an effect you engineer at the consumer, not a transport guarantee you buy. The real recipe:
- At-least-once delivery (durable broker, ack after commit).
- Idempotent consumer: processing the same message twice == processing it once.
- A dedup/idempotency store keyed by a stable message id or business key.
⚠️ Kafka "exactly-once semantics (EOS)" is real but scoped to Kafka. Idempotent producer + transactions give exactly-once for read-topic → process → write-topic-and-offsets inside Kafka. It does not cover external side effects — a DB write, an email, a charge. The moment a handler touches the outside world, you are back to at-least-once and must be idempotent. Never tell a stakeholder Kafka gives you exactly-once for a payment.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -1 lines · +4 tokens per session 060c3a759955
- 1mo ago Changed · -47 tokens per session 561ac6804eb2
- 1mo ago First seen · 537 lines · 72 tokens per session scan A dec2fecdd8d7
loom-event-driven is a skill published in the GitHub repository cosmix/loom (63 stars, last pushed 2d ago), licensed MIT. It adds 29 tokens to every session and 8,235 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
API Discoverability for Agents
Making self-hosted services agent-discoverable — bake in a machine-readable API description (OpenAPI spec or a minimal API.md) when building, and discover-first (spec paths, repo search) before probing when integrating.
sandbox-stable
Build or maintain Cloudflare Sandbox apps on the stable @cloudflare/sandbox package. Use sandbox-next for preview apps and sandbox-migrate-to-next for stable-to-preview migrations.
durable-objects
Build, debug, or review Cloudflare Durable Objects code for persistent state and coordination.
sandbox-next
Build or maintain Cloudflare Sandbox apps on @cloudflare/sandbox@next (SDK 1.0 preview). Use sandbox-migrate-to-next when porting a stable app.
cloudflare
Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security. Use for architecture and product selection, including when the user describes a need without naming a Cloudflare product; then find the relevant skill or documentation.
cloudflare-email-service
Implement or troubleshoot Cloudflare Email Sending and Email Routing integrations and their delivery configuration.