Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Dianel555/DSkills --skill ace-toolgit clone --depth 1 https://github.com/Dianel555/DSkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dianel555/dskills/ace-tool)<a href="https://agentmods.dev/skills/dianel555/dskills/ace-tool"><img src="https://agentmods.dev/badge/skills/dianel555/dskills/ace-tool/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dianel555/dskills/ace-tool"><img src="https://agentmods.dev/badge/skills/dianel555/dskills/ace-tool.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 184 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 188 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 195 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Excessive Agency · line 289 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.03148 |
| Opus 5 | $0.00062 | $0.01574 |
| Sonnet 5 | $0.00025 | $0.00630 |
| Haiku 4.5 | $0.00012 | $0.00315 |
Grade A, and why
ace-tool scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 294 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ACE-Tool - Semantic Code Search & Prompt Enhancement
High-performance semantic search, code indexing, and AI-powered prompt enhancement. Standalone CLI (no MCP dependency).
Execution Methods
# Prerequisites: pip install httpx tenacity
# Environment: ACE_API_URL, ACE_API_TOKEN (optional for local fallback)
# Index project for remote search (upload code blobs to ACE service)
python scripts/ace_cli.py index -p /path/to/project
# Search codebase with natural language (remote if API configured, else local fallback)
python scripts/ace_cli.py search_context -p /path/to/project -q "function that handles authentication"
# Enhance prompt (interactive mode - default, opens browser)
python scripts/ace_cli.py enhance_prompt -p "implement login feature" -H "User: what auth method?\nAssistant: JWT"
# Enhance prompt (non-interactive, JSON output)
python scripts/ace_cli.py enhance_prompt --no-interactive -p "implement login feature"
# Enhance prompt with project context (enables cloud retrieval for all endpoints)
python scripts/ace_cli.py enhance_prompt -p "implement login feature" --project-root /path/to/project
# Enhance prompt with specific endpoint
python scripts/ace_cli.py --endpoint claude enhance_prompt -p "implement login feature"
# Enhance prompt with codex endpoint
python scripts/ace_cli.py --endpoint codex enhance_prompt -p "implement feature"
# Check configuration
python scripts/ace_cli.py get_config
Tool Routing Policy
Prefer ACE-Tool Over Built-in Tools
| Task | Avoid | Use ACE-Tool CLI |
|---|---|---|
| Find function by purpose | grep "def func" |
search_context -q "function that..." |
| Locate feature code | find . -name "*.py" |
search_context -q "feature description" |
| Clarify requirements | Manual analysis | enhance_prompt -p "requirement" |
| Understand code flow | Multiple grep/read | search_context -q "flow description" |
| Index codebase | N/A | index -p <project_root> |
When to Use Built-in Tools
- Exact string matching (known identifiers)
- File path patterns (known naming conventions)
- Simple text replacement
What ships with it
21 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .env.example 2.5 KB
- README.md 12 KB
- scripts/__init__.py 525 B runs code
- scripts/__main__.py 125 B runs code
- scripts/ace_cli.py 5.3 KB runs code
- scripts/client.py 30 KB runs code
- scripts/indexer.py 15 KB runs code
- scripts/templates.py 4.5 KB runs code
- scripts/utils.py 6.6 KB runs code
- scripts/web_ui.py 21 KB runs code
- tests/__init__.py 0 B runs code
- tests/conftest.py 113 B runs code
- tests/test_auth_upgrade.py 8.0 KB runs code
- tests/test_cli.py 3.0 KB runs code
- tests/test_client_auth_integration.py 5.1 KB runs code
- tests/test_client_endpoints.py 3.6 KB runs code
- tests/test_codex_endpoint.py 2.9 KB runs code
- tests/test_indexer_ignore.py 1.8 KB runs code
- tests/test_reasoning_effort.py 4.0 KB runs code
- tests/test_search_context.py 4.1 KB runs code
- tests/test_url_and_400error.py 15 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 294 lines · 124 tokens per session scan A aca12b18390c
ace-tool is a skill published in the GitHub repository Dianel555/DSkills (64 stars, last pushed 2d ago), licensed MIT. It adds 124 tokens to every session and 3,148 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
geekx-gate
A review framework for deciding whether an engineering idea or technical commitment is necessary, too broad, or premature. It examines the real problem, complexity, evidence, non-goals, and ease of reversal.
geekx-engineering
A set of engineering instructions for making substantial changes in an existing codebase. It emphasizes understanding the affected system, keeping a persistent plan, and recording decisions and evidence.
casely
Virtual QA Lead that turns requirement documents into review-ready, TestRail-importable test cases in one conversation — no commands to memorize. Use this skill whenever the user has requirements, a spec, a user story, or acceptance criteria (PDF, DOCX, XLSX, TXT, MD, or pasted text) and wants test cases, a test plan…
geekx-grilling
A questioning workflow for pressure-testing plans, decisions, requirements, and proposed solutions. It asks one important question at a time and uses the answers to clarify facts, choices, dependencies, scope, and exclusions.
battle-tested-engineer
Engineering judgment for code write/refactor/test and frontend UI. Trigger on code review, legacy cleanup, tests, UI with data, bloat/over-engineer complaints — even with no explicit mention, before any diff/rewrite/test suite. Output ultra-terse caveman style; code, commits, PR desc, security warnings stay normal…
tryworld-paper
A workflow for turning a Chinese voiceover script and optional images into a branded 16:9 AI-knowledge video in the “Paper Algorithm” style.