Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add desirecore/market --skill nodejs-runtimegit clone --depth 1 https://github.com/desirecore/marketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/desirecore/market/nodejs-runtime)<a href="https://agentmods.dev/skills/desirecore/market/nodejs-runtime"><img src="https://agentmods.dev/badge/skills/desirecore/market/nodejs-runtime/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/desirecore/market/nodejs-runtime"><img src="https://agentmods.dev/badge/skills/desirecore/market/nodejs-runtime.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00230 | $0.02728 |
| Opus 5.5 | $0.00092 | $0.01091 |
| Sonnet 5.5 | $0.00046 | $0.00546 |
| Haiku 4.5 | $0.00023 | $0.00273 |
Grade D, and why
nodejs-runtime scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| Debian/Ubuntu | NodeSource: `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt install nodejs` | Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
| Fedora/RHEL | `curl -fsSL https://rpm.nodesource.com/setup_22.x \| sudo bash - && sudo dnf install nodejs` | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sk "${BASE}/node/available" How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
nodejs-runtime Skill
L0: One-line Summary
When to use: the user needs to install Node.js / upgrade Node / switch Node multi-version / install or configure
npm / pnpm / yarn / troubleshoot node: command not found, npm: command not found,
EACCES global install permission errors, node-gyp build failures, registry mirror / proxy issues, or other
Node.js runtime problems, or when other skills (pptx using pptxgenjs, etc.) report "Node.js unavailable".
How: prefer the DesireCore built-in Volta and follow a four-tier fallback (HTTP API → Volta CLI → system package manager brew/apt/NodeSource/winget → community options nvm/fnm).
L1: Overview and Use Cases
Capability Description
Procedural skill. Before each Node.js environment operation, run scripts/probe-node.sh to obtain a JSON snapshot, then choose a path according to the four-tier fallback in ../dev-environment-setup/references/decision-tree.md.
Use Cases
- "node not found" / "npm not found"
- The user requests to install/upgrade Node.js
- Multi-version switching (based on
package.json#voltaor.nvmrc) - Install/manage pnpm / yarn / npm
- "EACCES: permission denied" (npm global install permission error)
- Configure registry / proxy
- Other skills (pptx, etc.) report Node.js unavailable
Core Value
- DesireCore first: Volta + HTTP API as L1/L2, avoiding pollution of the system Node
- JSON-driven decisions: the probe script outputs structured data that Claude can parse directly
- package.json#volta compatible: Volta automatically switches versions per project
L2: Detailed Specification
Step 1: Environment Probe (mandatory)
bash skills/nodejs-runtime/scripts/probe-node.sh > /tmp/node-probe.json
cat /tmp/node-probe.json | jq .
See ../dev-environment-setup/references/probe-snapshot.md for field definitions.
Step 2: Choose an Execution Path
| Condition | Path |
|---|---|
desirecore_api non-empty |
L1 HTTP API |
desirecore_api empty, volta_path non-empty |
L2 Volta CLI |
| Neither of the above | L3 System package manager (brew / apt / NodeSource / winget) |
| L1–L3 all fail or user explicitly requests | L4 Community options (nvm / fnm) |
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +1 lines eb2e11cc9a27
- 1mo ago First seen · 216 lines · 230 tokens per session scan D 7c71b82b7f5f
nodejs-runtime is a skill published in the GitHub repository desirecore/market (2 stars, last pushed 2d ago), licensed MIT. It adds 230 tokens to every session and 2,728 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
upgrade-packages-js
Safely upgrade JavaScript packages with breaking change detection, migration guidance, and automated code migrations (npm/pnpm/yarn). Cross-platform with git safety branch enforcement.
psl-ast-layers
How to use the PSL syntax tree layers (green tree, red tree, strongly-typed AST classes) correctly. Use for any PSL-related work: PSL interpreters (contract-psl), helpers inside the psl-parser package, the language server, formatters, or anything else that consumes parse() output from @internal/psl-parser.
ast-visitor-pattern
Use the frozen-class/visitor pattern for discriminated unions that have multiple dispatch sites. Use when creating a new set of variants (commands, IR nodes, factory calls) that will be switched over in 2+ places, or when refactoring an existing union type that has grown multiple switch sites.
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
bumping-biome
Bumps biome package versions (e.g. @biomejs/biome) using pnpm, aligns biome.jsonc files with the new version/s across the repository and runs biome-related checks. Use when required to update biome to a newer version - explicitly or implicitly (e.g. after running pnpm up, pnpm update, pnpm upgrade without specific…
node-modules-inspector
Inspects a project's installed nodemodules and produces three reports: duplicated packages (installed in multiple versions), packages sorted by install size, and maintenance actions (dep-upgrade opportunities + publint findings, grouped by consumer/author). Use when the user wants to audit dependencies, find duplicate…