Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/desirecore/market/nodejs-runtimenpx skills add desirecore/market --skill nodejs-runtimegit clone --depth 1 https://github.com/desirecore/marketWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00230 | $0.02723 |
| Opus 5 | $0.00115 | $0.01362 |
| Sonnet 5 | $0.00046 | $0.00545 |
| Haiku 4.5 | $0.00023 | $0.00272 |
Grade D, and why
nodejs-runtime scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| Debian/Ubuntu | NodeSource: `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt install nodejs` | Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
| Fedora/RHEL | `curl -fsSL https://rpm.nodesource.com/setup_22.x \| sudo bash - && sudo dnf install nodejs` | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sk "${BASE}/node/available" How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
nodejs-runtime Skill
L0: One-line Summary
When to use: the user needs to install Node.js / upgrade Node / switch Node multi-version / install or configure
npm / pnpm / yarn / troubleshoot node: command not found, npm: command not found,
EACCES global install permission errors, node-gyp build failures, registry mirror / proxy issues, or other
Node.js runtime problems, or when other skills (pptx using pptxgenjs, etc.) report "Node.js unavailable".
How: prefer the DesireCore built-in Volta and follow a four-tier fallback (HTTP API → Volta CLI → system package manager brew/apt/NodeSource/winget → community options nvm/fnm).
L1: Overview and Use Cases
Capability Description
Procedural skill. Before each Node.js environment operation, run scripts/probe-node.sh to obtain a JSON snapshot, then choose a path according to the four-tier fallback in ../dev-environment-setup/references/decision-tree.md.
Use Cases
- "node not found" / "npm not found"
- The user requests to install/upgrade Node.js
- Multi-version switching (based on
package.json#voltaor.nvmrc) - Install/manage pnpm / yarn / npm
- "EACCES: permission denied" (npm global install permission error)
- Configure registry / proxy
- Other skills (pptx, etc.) report Node.js unavailable
Core Value
- DesireCore first: Volta + HTTP API as L1/L2, avoiding pollution of the system Node
- JSON-driven decisions: the probe script outputs structured data that Claude can parse directly
- package.json#volta compatible: Volta automatically switches versions per project
L2: Detailed Specification
Step 1: Environment Probe (mandatory)
bash skills/nodejs-runtime/scripts/probe-node.sh > /tmp/node-probe.json
cat /tmp/node-probe.json | jq .
See ../dev-environment-setup/references/probe-snapshot.md for field definitions.
Step 2: Choose an Execution Path
| Condition | Path |
|---|---|
desirecore_api non-empty |
L1 HTTP API |
desirecore_api empty, volta_path non-empty |
L2 Volta CLI |
| Neither of the above | L3 System package manager (brew / apt / NodeSource / winget) |
| L1–L3 all fail or user explicitly requests | L4 Community options (nvm / fnm) |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 216 lines · 230 tokens per session scan D 7c71b82b7f5f
nodejs-runtime is a skill published in the GitHub repository desirecore/market (2 stars, last pushed 2d ago), licensed MIT. It adds 230 tokens to every session and 2,723 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
npm-security
Prevent JavaScript/TypeScript projects from supply-chain attacks across package managers like npm, pnpm, yarn, bun, and deno. Use whenever planning, installing, updating packages or configuring package managers.
dependency-audit
依赖漏洞审计。适用于 npm、yarn、pnpm、lockfile、本地目录和远程 Git 仓库的依赖风险审计场景；前端项目的依赖漏洞审计优先使用 locklens。.
tiny-web-crawler
Crawl from one or more starting web pages, fetch readable content, search within pages, follow relevant links, and stop when the requested information is found or a bounded limit is reached.
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
opendia-harness
Install, configure, and troubleshoot OpenDia for Grok Build (and other MCP harnesses). Use when setting up the plugin, config.toml MCP entry, ports, extension disconnects, tool timeouts, or tunnel mode.
stock-api
Fetch real-time stock quotes, K-line (candlestick) history, and search symbols for China A-shares, Hong Kong, and US markets. Use when the user asks for a stock price, a quote, market data, candlestick/K-line data, or to look up a stock code by company name.