Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add diagrid-labs/dapr-skills --skill add-pubsub-dotnetgit clone --depth 1 https://github.com/diagrid-labs/dapr-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/diagrid-labs/dapr-skills/add-pubsub-dotnet)<a href="https://agentmods.dev/skills/diagrid-labs/dapr-skills/add-pubsub-dotnet"><img src="https://agentmods.dev/badge/skills/diagrid-labs/dapr-skills/add-pubsub-dotnet/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/diagrid-labs/dapr-skills/add-pubsub-dotnet"><img src="https://agentmods.dev/badge/skills/diagrid-labs/dapr-skills/add-pubsub-dotnet.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.03862 |
| Opus 5.5 | $0.00033 | $0.01545 |
| Sonnet 5.5 | $0.00017 | $0.00772 |
| Haiku 4.5 | $0.00008 | $0.00386 |
Grade A, and why
add-pubsub-dotnet scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add Dapr pub/sub to an existing .NET project
Overview
This skill adds Dapr pub/sub (publisher, subscriber or both) to an ASP.NET Core project that already exists. It changes nothing before the user approves a written plan, edits existing files with the smallest possible change, follows the project's own conventions and the subscription type it already uses, builds the solution after every step and runs the existing tests at the end. It never changes git state.
Execution Order
You MUST follow these phases in strict order:
- Resolve target — read-only inspection of the solution, project and existing Dapr wiring.
- Check specification — role, subscription type, topic, message type, features.
- Check optional tools — Diagrid Dapr Dev Dashboard check; never stops the skill.
- Plan and approval — show the Add Pub/Sub Plan with its two questions (package updates, publishing from an existing endpoint) and wait for approval.
- Apply — one step at a time, building after each.
- Final verification — build and test the whole solution.
- Write the run doc —
DAPR-PUBSUB.mdat the solution root (the project folder when there is no solution file). - Show final message — your output MUST end with EXACTLY the message in
## Show final messagefollowed by the Dev Dashboard recommendation. No other text after it.
Prerequisites
The user must have installed:
- .NET SDK 8.0 or later that supports the project's target framework. Check with
dotnet --version: the SDK major version must be at least the target framework's major version (net8.0 → 8+, net9.0 → 9+, net10.0 → 10+). If aglobal.jsonpins an SDK, that SDK must be installed. - Docker or Podman
- Dapr CLI 1.18+ (not needed to build; needed to run)
- Aspire solutions only: the Aspire CLI to start the solution with
aspire run(not needed to build) - Optional: the Diagrid Dapr Dev Dashboard. The skill only checks whether it is installed; it never installs it and never stops without it.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · -4 lines · -65 tokens per session 7d04f91eb9b4
- 10d ago Changed e97b20517747
- 12d ago First seen · 129 lines · 148 tokens per session scan A fa84b54c0800
add-pubsub-dotnet is a skill published in the GitHub repository diagrid-labs/dapr-skills (13 stars, last pushed 8d ago), licensed MIT. It adds 83 tokens to every session and 3,862 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other skills, from other repositories
offensive-api-abuse
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query…
offensive-graphql
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested…
api-security-best-practices
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities.
agent-ready-auth-md
Sub-skill: Implement Auth.md for agent registration discovery. Serve /auth.md with OAuth metadata at /.well-known/oauth-protected-resource and authorization server endpoints.
agent-ready-dns-aid
Sub-skill: Implement DNS-AID records so agents discover endpoints through DNS. Use SVCB/HTTPS records under agents namespace with alpn and connection parameters.
agent-ready-link-headers
Sub-skill de agent-ready-cloudflare: Implement Link Response Headers.