Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/data-wise/craft/homebrew-formula-expertnpx skills add Data-Wise/craft --skill homebrew-formula-expertgit clone --depth 1 https://github.com/Data-Wise/craftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/data-wise/craft/homebrew-formula-expert)<a href="https://agentmods.dev/skills/data-wise/craft/homebrew-formula-expert"><img src="https://agentmods.dev/badge/skills/data-wise/craft/homebrew-formula-expert.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02885 |
| Opus 5 | $0.00032 | $0.01443 |
| Sonnet 5 | $0.00013 | $0.00577 |
| Haiku 4.5 | $0.00006 | $0.00288 |
Grade B, and why
homebrew-formula-expert scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
SETTINGS_FILE="$HOME/.claude/settings.json" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$TARGET_DIR" 2>/dev/null || true Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sL https://github.com/user/repo/archive/v1.0.0.tar.gz | shasum -a 256 How it starts
The opening of the file, as written. The whole thing — 444 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Homebrew Formula Expert
Deep expertise in Homebrew formula creation, maintenance, and best practices.
Surface scope: Homebrew installs plugins to the Claude Code CLI surface (
~/.claude/). Claude Desktop (DXT/MCPB extensions — a different, MCP-server format) and Cowork are separate surfaces; seedist-extrasandcommands/dist/surfaces.mdfor the full model.
Formula Anatomy
class MyApp < Formula
# Metadata
desc "Short description (< 80 chars, no 'A' or 'An' prefix)"
homepage "https://github.com/user/repo"
url "https://github.com/user/repo/archive/v1.0.0.tar.gz"
sha256 "64-char-hex-string"
license "MIT" # SPDX identifier
head "https://github.com/user/repo.git", branch: "main"
# Dependencies
depends_on "[email protected]"
depends_on "cmake" => :build # Build-time only
# Installation
def install
# Installation logic
end
# Verification
test do
# Test that installation worked
end
end
Language-Specific Patterns
Python (virtualenv)
class MyPythonApp < Formula
include Language::Python::Virtualenv
desc "My Python application"
homepage "https://github.com/user/repo"
url "https://github.com/user/repo/archive/v1.0.0.tar.gz"
sha256 "..."
license "MIT"
depends_on "[email protected]"
# For packages with many deps, list resources
resource "requests" do
url "https://files.pythonhosted.org/..."
sha256 "..."
end
def install
virtualenv_install_with_resources
# Or manual:
# venv = virtualenv_create(libexec, "python3.12")
# venv.pip_install resources
# venv.pip_install buildpath
# bin.install_symlink libexec/"bin/myapp"
end
test do
assert_match version.to_s, shell_output("#{bin}/myapp --version")
end
end
Node.js
class MyNodeApp < Formula
desc "My Node.js application"
homepage "https://github.com/user/repo"
url "https://registry.npmjs.org/myapp/-/myapp-1.0.0.tgz"
sha256 "..."
license "MIT"
depends_on "node"
def install
system "npm", "install", *std_npm_args
bin.install_symlink Dir["#{libexec}/bin/*"]
end
test do
assert_match version.to_s, shell_output("#{bin}/myapp --version")
end
end
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 444 lines · 65 tokens per session scan B cc0bfe3eaa56
homebrew-formula-expert is a skill published in the GitHub repository Data-Wise/craft (4 stars, last pushed 2d ago), licensed MIT. It adds 65 tokens to every session and 2,885 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 3 findings (reads agent configuration directories, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
audit-full
Single-pass codebase analysis leveraging a 1M-token context window for comprehensive security scanning, architecture review, and dependency auditing. Loads entire codebases for cross-file pattern detection and generates structured audit reports with severity-ranked findings. Use when you need whole-project analysis…
explore
Multi-angle codebase exploration spawning 3-5 parallel agents for code structure, data flow, architecture patterns, and health assessment. Generates ASCII visualizations, import graphs, and design pattern detection with cross-session memory storage. Use when exploring a repo, discovering architecture, onboarding to a…
architecture-decision-record
ADR templates in the Nygard format with context, decision, consequences, and alternatives. Use when writing ADRs, recording an architectural decision, or evaluating options.
scope-appropriate-architecture
Right-sizes architecture to project scope, classifying projects into 6 tiers to prevent over-engineering. Use when designing architecture, selecting patterns, or detecting a project tier.
architecture-review
Conducts a comprehensive multi-perspective architecture review using ALL architecture team members. Use when the user requests "Start architecture review", "Full architecture review", "Review architecture for version X.Y.Z", "Conduct comprehensive review", or when they want assessment from multiple perspectives. Do…
architecture-status
Reports on the health and state of architecture documentation (counts of ADRs, reviews, activity levels, documentation gaps). Use when the user asks "What's our architecture status?", "Show architecture documentation", "How many ADRs do we have?", "What decisions are documented?", "Architecture health check", or wants…