Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CrestApps/CrestApps.AgentSkills --skill orchardcore-graphqlgit clone --depth 1 https://github.com/CrestApps/CrestApps.AgentSkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/crestapps/crestapps.agentskills/orchardcore-graphql)<a href="https://agentmods.dev/skills/crestapps/crestapps.agentskills/orchardcore-graphql"><img src="https://agentmods.dev/badge/skills/crestapps/crestapps.agentskills/orchardcore-graphql/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/crestapps/crestapps.agentskills/orchardcore-graphql"><img src="https://agentmods.dev/badge/skills/crestapps/crestapps.agentskills/orchardcore-graphql.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.00645 |
| Opus 5.5 | $0.00041 | $0.00258 |
| Sonnet 5.5 | $0.00020 | $0.00129 |
| Haiku 4.5 | $0.00010 | $0.00064 |
Grade A, and why
orchardcore-graphql scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchard Core GraphQL
Enable OrchardCore.Apis.GraphQL for /api/graphql. The endpoint requires
ExecuteGraphQL; mutations additionally require
ExecuteGraphQLMutations. Content access is also limited by the caller's
content-view permissions. A JWT bearer principal must therefore receive the
same Orchard permissions through its user or role before it can query content.
{
"steps": [
{
"name": "Feature",
"enable": [
"OrchardCore.Apis.GraphQL"
]
}
]
}
Use GraphiQL in the admin UI to inspect the schema and generated field names.
Do not embed a fictional Liquid graphql tag; execute GraphQL through its
HTTP endpoint or application code.
Graph Types and Where Filters
InputObjectGraphType<T> models an ordinary input object. It does not
automatically create predicate suffixes such as _contains. For indexed
content filtering, derive from WhereInputObjectGraphType<T> and use its
filter-field helpers.
using GraphQL.Types;
using Microsoft.Extensions.Localization;
using OrchardCore.Apis.GraphQL.Queries;
namespace MyModule;
public sealed class ProductWhereInput : WhereInputObjectGraphType<ProductIndex>
{
public ProductWhereInput(IStringLocalizer<ProductWhereInput> localizer)
: base(localizer)
{
AddScalarFilterFields<StringGraphType>(
fieldName: nameof(ProductIndex.Sku),
description: "Product SKU",
aliasName: "Product",
contentPart: "ProductPart",
contentField: "Sku");
}
}
Register a map index with the dedicated extension:
services.AddWhereInputIndexPropertyProvider<ProductIndex>();
Index Aliases
IIndexAliasProvider is asynchronous in v3:
using OrchardCore.ContentManagement.GraphQL.Queries;
namespace MyModule;
public sealed class ProductIndexAliasProvider : IIndexAliasProvider
{
public ValueTask<IEnumerable<IndexAlias>> GetAliasesAsync()
{
IEnumerable<IndexAlias> aliases =
[
new IndexAlias
{
Alias = "Product",
Index = nameof(ProductIndex),
IndexType = typeof(ProductIndex),
},
];
return ValueTask.FromResult(aliases);
}
}
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 103 lines · 102 tokens per session scan A c3197dfb7253
orchardcore-graphql is a skill published in the GitHub repository CrestApps/CrestApps.AgentSkills (13 stars, last pushed 2d ago), licensed MIT. It adds 102 tokens to every session and 645 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-12.
Other skills, from other repositories
n8n-code-tool
Write JavaScript or Python for the n8n Custom Code Tool (@n8n/n8n-nodes-langchain.toolCode) — the AI-agent-callable tool, NOT the workflow Code node. Use when building a Code Tool attached to an AI Agent, writing code that an LLM will invoke, parsing the query input, returning a string result, defining an input schema…
clean-architecture-dotnet
Use when domain logic leaks into API/Infrastructure, project references violate layer boundaries, or you need to decide between CQS (always), CQRS bus (complex domains), and DDD patterns (invariants and events).
tech-specs
To define clear, testable tech specs from requirements — target-state architecture, contracts, interfaces.
contentful-cms
Contentful content types, GraphQL/REST queries, CLI migrations, assets and locales. Use when changing a Contentful content model, querying Contentful, or migrating its content.
sfcc-job-development
Guide for developing custom jobs in Salesforce B2C Commerce Job Framework. Use this when asked to create batch jobs, scheduled tasks, chunk-oriented processing, or task-oriented jobs.
sfcc-hooks-registration
Register SFCC hooks via cartridge package.json and hooks.json. Use when adding hooks or troubleshooting hook registration.