Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cosmix/loom --skill loom-plan-writergit clone --depth 1 https://github.com/cosmix/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cosmix/loom/loom-plan-writer)<a href="https://agentmods.dev/skills/cosmix/loom/loom-plan-writer"><img src="https://agentmods.dev/badge/skills/cosmix/loom/loom-plan-writer.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 8 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 148 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- high Prompt Injection · line 214 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 772 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Privilege Escalation · line 838 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 8 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 390 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 608 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 830 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.25022 |
| Opus 5 | $0.00007 | $0.12511 |
| Sonnet 5 | $0.00003 | $0.05004 |
| Haiku 4.5 | $0.00001 | $0.02502 |
Grade A, and why
loom-plan-writer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `acceptance` | Build/test/lint AND observable behavior | `"cargo test"`, `"myapp new-cmd --help"`, `"curl -f localhost:8080/health"` | How it starts
The opening of the file, as written. The whole thing — 1,174 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Loom Plan Writer
THE REQUIRED SKILL FOR CREATING LOOM EXECUTION PLANS. Invoke it whenever an agent needs to author a plan for loom orchestration.
A loom plan is a DAG of stages that loom runs in isolated git worktrees. It maximizes throughput with two levels of parallelism — subagents within a stage (FIRST priority) and concurrent worktree stages (SECOND) — and it is only as good as its CLAIMS about the code are TRUE and its verification actually PROVES them.
This skill assumes CLAUDE.md is in context (it always is under loom). Where CLAUDE.md already governs something — subagent preambles (Rule 5), hierarchies (Rule 6), memory routing (Rule 12/18), branch discipline — this skill points at it rather than restating it.
Two rules dominate everything below:
- Ground every claim before you write it (Section 1) — the #1 cause of bad plans.
- The plan file is your deliverable. After writing it, STOP (Section 11) — never implement.
1. Ground Every Claim (READ THE SEAM)
⚠️ A plan is a set of CLAIMS about code: "this function does X," "this enum's consumers are Y," "this field is safe to add," "this command type-checks." Every claim is WRONG until the code confirms it. The design spine is usually sound — defects hide in UNREAD seams. A file the plan NAMES is a promise to read; a described file is an unread file.
Before any stage description, acceptance, artifacts, wiring, or wiring_tests asserts anything about a seam, OPEN that seam and read it to the bottom. Never assert from memory, a sibling repo, a plausible filename, or "it usually works this way." The repo's own incident/runbook docs are PRIMARY — read the one the user has open before encoding an external system's behavior from memory.
VERIFY-BEFORE-WRITE CHECKLIST — run for every stage:
□ Every file the stage NAMES, I have OPENED (not inferred from its name).
□ Every symbol the stage CHANGES, I grepped for every importer/consumer across
the WHOLE repo (BOTH packages in a monorepo) — and followed each edge ONE ring
out (callers/renderers I did not already think of).
□ Every behavior the stage ASSERTS (a guard enforces X, an error code is
terminal, a field is safe, a command type-checks) — I read the implementation
that provides it, including catch-alls and branch ORDER.
□ Every value/behavior the design LEANS ON, I read the line that PRODUCES it (not
the type/schema/getter that DESCRIBES it) AND confirmed it holds in EACH
environment that runs the code (prod vs dev, build-time vs unit-test vs e2e,
container env set, same-origin vs cross-origin). "The symbol is defined" ≠ "it
holds the right value in the runtime that executes THIS code."
□ Every RULE the plan states about ONE site ("reset this global here," "keep env
clean for this boot path") — I grepped its structural SIBLINGS (same-shape
modules, every importer) and applied it to ALL in the same pass, not as a
one-off note.
□ Every message / limit / line / count / status code / external behavior /
package dependency is READ from its source, never recalled.
□ No claim rests on memory, a sibling repo, or a plausible name.
□ Every claim about a SIBLING PLAN's surface (upstream symbol, consumer seam,
file owner) passed the Cross-Plan Contract Protocol — verified against
committed code or the sibling's stage YAML, never its prose.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 9fccc7684763
- 2d ago Changed c84303b7baa8
- 4d ago Changed · +143 lines · -31 tokens per session 17111e4c137b
- 8d ago First seen · 1,030 lines · 45 tokens per session scan A 8d7a0511e6ac
loom-plan-writer is a skill published in the GitHub repository cosmix/loom (54 stars, last pushed yesterday), licensed MIT. It adds 14 tokens to every session and 25,022 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-upstream-pr
Improve an open-source GitHub skill and open a friendly suggestion PR upstream: fork, run skill-auto-improver, attach asm eval before/after metrics. Don't use for local-only skills, authoring from scratch, bulk repos, or registry publish.
meanest-editor
Roast a pitch or press release with the eye of a veteran PR director. Honest, sharp, constructive — never cruel for its own sake.
headline-generator
Generate headline candidates from a story's raw facts: news-style headlines, press-release headlines, and pitch subject lines. A pure generation skill — it finds the charge in the facts, then runs ten proven moves (consequence, picture, number-as-hero, two-beat turn, naming, reader's-own-story, open question, voice…
ai-visibility-writing
Audit, question, suggest, or fact-preservingly revise a press release, blog post, contributed article, or expert explainer so AI answer systems can more easily retrieve, understand, quote, and cite its useful information. Use when someone asks for AI visibility, AI search, answer-engine, AEO, GEO, AI Overview, or…
docs-updater
Provides automated documentation updates by analyzing git changes between the current branch and the last release tag. Performs git diff analysis to identify modifications, then updates README.md, CHANGELOG.md following Keep a Changelog standard, and discovers documentation folders for contextual updates. Use when…
github-issue-workflow
Provides a structured 8-phase workflow for resolving GitHub issues in Claude Code. Covers fetching issue details, analyzing requirements, implementing solutions, verifying correctness, performing code review, committing changes, and creating pull requests. Use when user asks to resolve, implement, work on, fix, or…