What is orchardcore-downloads?

A digital-download add-on for Orchard Core commerce sites. It stores product files privately, grants access after an order is paid, and delivers files through signed links that expire.

Use it to upload private digital files, grant and revoke download rights when orders are paid or refunded, and deliver files through protected links.

It prevents sellable files from being exposed as ordinary public media and ties download access to the buyer's payment and refund status.

orchardcore-downloads — Skill for Claude Code by CrestApps

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add CrestApps/CrestApps.AgentSkills --skill orchardcore-downloads

Clone the repo

git clone --depth 1 https://github.com/CrestApps/CrestApps.AgentSkills

Made for: Claude Code.

Or install crestapps-orchardcore, the plugin that ships this one along with the rest of its 94 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/crestapps/crestapps.agentskills/orchardcore-downloads/github.svg)](https://agentmods.dev/skills/crestapps/crestapps.agentskills/orchardcore-downloads)

Your own site

<a href="https://agentmods.dev/skills/crestapps/crestapps.agentskills/orchardcore-downloads"><img src="https://agentmods.dev/badge/skills/crestapps/crestapps.agentskills/orchardcore-downloads/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/crestapps/crestapps.agentskills/orchardcore-downloads"><img src="https://agentmods.dev/badge/skills/crestapps/crestapps.agentskills/orchardcore-downloads.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 164 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,903 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00164	$0.01903
Opus 5.5	$0.00066	$0.00761
Sonnet 5.5	$0.00033	$0.00381
Haiku 4.5	$0.00016	$0.00190

Measured today against content hash 80e0ac882648, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

orchardcore-downloads scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/crestapps-orchardcore/skills/orchardcore-downloads/SKILL.md · 107 lines

How it starts

The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Orchard Core Digital Downloads - Prompt Templates

Deliver Digital Products

You are an Orchard Core expert. Generate accurate setup, recipes and extension guidance for the CrestApps Digital Downloads module, which keeps a product's files privately, grants them to buyers when an order is paid, and serves them through signed, expiring links.

Guidelines

Install CrestApps.OrchardCore.Downloads (or the CrestApps.OrchardCore.Cms.Core.Targets bundle) in the web/startup project.
Enable CrestApps.OrchardCore.Downloads. It depends on CrestApps.OrchardCore.Commerce, CrestApps.OrchardCore.Products, CrestApps.OrchardCore.Orders and OrchardCore.Contents. Selling also needs Carts and CrestApps.OrchardCore.Checkout with a payment provider (see orchardcore-products, orchardcore-checkout and orchardcore-payments).
Enable CrestApps.OrchardCore.Customers so a guest's Contact step asks for the email the links go to (see orchardcore-customers).
Never put sellable files in the media library. Files go to IDigitalFileStore, which no URL serves.
Enable an antivirus feature such as OrchardCore.Antivirus.ClamAV to scan uploads. Uploads run through Orchard Core's FileCreationService and every IFileEventHandler (see orchardcore-file-upload-security and orchardcore-antivirus).
Set the site's Base URL so links in emails work outside a request.
Orders and carts are covered by orchardcore-orders and orchardcore-carts; the shared Commerce menu and storefront account by orchardcore-commerce.
All recipe JSON must be wrapped in { "steps": [...] }.
All C# classes must use the sealed modifier, except View Models.

Feature and Services

Item	Value
Feature ID	`CrestApps.OrchardCore.Downloads`
Content part	`DigitalFilesPart` (`Files`, `DownloadLimit`, `LinkLifetimeDays`)
File store	`IDigitalFileStore` (`SaveAsync`, `FindAsync`, `OpenAsync`), folder `App_Data/.../DigitalFiles/{fileId}/{fileName}`
Entitlements	`DownloadEntitlement` in collection `Downloads`, `DownloadEntitlementIndex`
Service	`DownloadService` (`GrantAsync`, `ListAsync`, `CreateUrlAsync`, `ResolveAsync`, `RecordDownloadAsync`, `RevokeOrderAsync`, `RevokeAsync`, `ResetAsync`)
Site settings	`DownloadSettings` (group `downloads`, Settings > Commerce > Downloads): `DownloadLimit` 5, `LinkLifetimeDays` 30
Order seams	`DownloadOrderEventHandler` (`OrderGrantHandlerBase`), `IOrderEmailSectionProvider`, `OrderDownloadsDisplayDriver`
Permission	`ManageDigitalDownloads` ("Manage digital files and downloads"; Administrator, Store manager), also guards the settings group
Recipe step	`DigitalFiles` (needs `OrchardCore.Recipes.Core`)
Report	Downloads under Reports > Commerce (with `CrestApps.OrchardCore.Reports`)
Sample recipe	Digital downloads sample: a Digital Product type, two ebooks with PDFs, an Ebooks listing, coupons WELCOME10 and EBOOKS5

Read the full file on GitHub · 107 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today First seen · 107 lines · 164 tokens per session scan A 80e0ac882648

Subscribe to this mod's changes

orchardcore-downloads is a skill published in the GitHub repository CrestApps/CrestApps.AgentSkills (13 stars, last pushed today), licensed MIT. It adds 164 tokens to every session and 1,903 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-22.

E-commerce agent-skills ai ai-agents-framework dotnet mcp mcp-server

escalation

Escalate a disputed refund to the billing lead.

modelcontextprotocol/typescript-sdk · 15 tokens

sfcc-platform-limits

Cheat-sheet and design patterns for surviving SFCC quotas and limits (script timeouts, HTTPClient call caps, session size, custom object quotas, file I/O restrictions, and headless rate limits). Use this when debugging enforced quota violations or designing scalable SFCC architectures.

taurgis/sfcc-dev-mcp · 61 tokens

broker-schedule

Repricing schedule management. Sets the interval for automatic price research and repricing, and registers the system-level scheduler (launchd on macOS, cron on Linux). Use when user wants to set or change the repricing interval, or invoke /broker-schedule to view/manage existing schedules. Default interval: 7 days.

madguyevans-creator/resale-agent-skill-hub · 0 tokens

a1-yandex-kit-promotions

Manage promotions in a Yandex KIT store over its REST API: discounts, promo codes, promocode groups (shared codes and single-use coupon batches) and gifts. Use when creating or updating discounts, promocodes, promocode groups or gifts, or when binding them to products, categories or collections. Russian triggers…

ztemerbekov/a1-yandex-kit-skills · 113 tokens

a1-yandex-kit-catalog-doctor

A tool for auditing and repairing Yandex KIT product catalogues. Yandex KIT is an e-commerce system for managing products, orders, discounts, and related catalogue data.

ztemerbekov/a1-yandex-kit-skills · 130 tokens

verify

How to verify changes to the a1-yandex-kit-setup helper CLI at its real surface (setup.mjs), including the no-network sandbox scenario.

ztemerbekov/a1-yandex-kit-skills · 33 tokens