Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dirtcubeinteractive/specter-skills --skill specter-playersgit clone --depth 1 https://github.com/dirtcubeinteractive/specter-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dirtcubeinteractive/specter-skills/specter-players)<a href="https://agentmods.dev/skills/dirtcubeinteractive/specter-skills/specter-players"><img src="https://agentmods.dev/badge/skills/dirtcubeinteractive/specter-skills/specter-players/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dirtcubeinteractive/specter-skills/specter-players"><img src="https://agentmods.dev/badge/skills/dirtcubeinteractive/specter-skills/specter-players.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01218 |
| Opus 5 | $0.00050 | $0.00609 |
| Sonnet 5 | $0.00020 | $0.00244 |
| Haiku 4.5 | $0.00010 | $0.00122 |
Grade A, and why
specter-players scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Specter Players — auth, profiles, player data, friends
Base URL and headers: see the specter skill. Everything here is POST {base}/... with
api-key; player-scoped (player/me/*) endpoints also need Authorization: Bearer <token>.
Signing players in
Default recommendation for games: custom ID auth — silent login keyed to your own player identity (device id or your server's user id). No password UX, and one call handles both first launch and returning players:
POST /auth/login-custom
{ "customId": "device-or-player-id", "createAccount": true }
→ data: { accessToken, entityToken, user: {...} }
createAccount: true signs the player up automatically on first login. Full method list:
| Method | Signup | Login |
|---|---|---|
| Custom ID (silent) | auth/signup-custom |
auth/login-custom |
| Email + password | auth/signup-email |
auth/login-email |
| Username + password | auth/signup-username |
auth/login-username |
auth/signup-google |
auth/login-google |
|
| Apple | auth/signup-apple |
auth/login-apple |
auth/signup-facebook |
auth/login-facebook |
|
| Steam | auth/signup-steam |
auth/login-steam |
| Discord | auth/signup-discord |
auth/login-discord |
Password lifecycle: account/change-password (Bearer), account/forgot-password → emailed
link → account/reset-password.
Token lifecycle: access tokens expire ~1h. Refresh proactively with auth/refresh-token
(api-key auth; send entityToken + the expiring access token in the body) and check with
auth/validate-token (Bearer) on app resume. On 401, refresh once, then re-login.
Signup is the moment Specter initializes the player — wallets for every project currency, default inventory items, and battle pass tiers are created by a background queue right after signup. This takes a moment; don't assume wallets/inventory exist in the same frame as the signup response.
Account linking (avoid lost progress)
Players who start anonymously (custom ID) should be able to attach a recoverable login later:
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/javascript.md 2.1 KB
- examples/unity-csharp.md 3.1 KB
- references/api/account-change-password.md 609 B
- references/api/account-forgot-password.md 523 B
- references/api/account-link.md 583 B
- references/api/account-reset-password.md 682 B
- references/api/account-unlink.md 532 B
- references/api/account-update.md 589 B
- references/api/auth-apple-callback.md 245 B
- references/api/auth-callback.md 207 B
- references/api/auth-login-apple.md 511 B
- references/api/auth-login-custom.md 611 B
- references/api/auth-login-discord.md 420 B
- references/api/auth-login-email.md 671 B
- references/api/auth-login-facebook.md 425 B
- references/api/auth-login-google.md 403 B
- references/api/auth-login-steam.md 480 B
- references/api/auth-login-username.md 667 B
- references/api/auth-refresh-token.md 609 B
- references/api/auth-signup-apple.md 515 B
- references/api/auth-signup-custom.md 533 B
- references/api/auth-signup-discord.md 424 B
- references/api/auth-signup-email.md 593 B
- references/api/auth-signup-facebook.md 429 B
- references/api/auth-signup-google.md 407 B
- references/api/auth-signup-steam.md 484 B
- references/api/auth-signup-username.md 589 B
- references/api/auth-validate-token.md 567 B
- references/api/friends-accept-request.md 408 B
- references/api/friends-cancel-request.md 408 B
- references/api/friends-decline-request.md 412 B
- references/api/friends-remove.md 377 B
- references/api/friends-send-request.md 399 B
- references/api/player-get-collections.md 525 B
- references/api/player-get-data.md 557 B
- references/api/player-get-friends.md 687 B
- references/api/player-get-instant-battle-history.md 655 B
- references/api/player-get-inventory.md 716 B
- references/api/player-get-match-history.md 625 B
- references/api/player-get-profile.md 737 B
- references/api/player-get-progress.md 479 B
- references/api/player-get-reward-history.md 714 B
- references/api/player-get-rm-wallet-history.md 397 B
- references/api/player-get-single-data.md 571 B
- references/api/player-get-task-group-status.md 583 B
- references/api/player-get-task-progress.md 586 B
- references/api/player-get-task-status.md 598 B
- references/api/player-get-time-series-progress.md 599 B
- references/api/player-get-tournament-history.md 752 B
- references/api/player-get-wallet-balance.md 1.1 KB
- references/api/player-get-wallet-history.md 633 B
- references/api/player-me-get-collections.md 410 B
- references/api/player-me-get-data.md 614 B
- references/api/player-me-get-friends.md 365 B
- references/api/player-me-get-instant-battle-history.md 443 B
- references/api/player-me-get-inventory.md 402 B
- references/api/player-me-get-match-history.md 738 B
- references/api/player-me-get-party-details.md 359 B
- references/api/player-me-get-pending-friend-requests.md 409 B
- references/api/player-me-get-profile.md 567 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 107 lines · 100 tokens per session scan A 30886210c4fa
specter-players is a skill published in the GitHub repository dirtcubeinteractive/specter-skills (0 stars, last pushed 2mo ago), licensed MIT. It adds 100 tokens to every session and 1,218 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
league-akari-sgp-data-source
Use when implementing or reviewing League Akari SGP/LCU data-source selection, SGP API clients, League Servers remote config, Tencent cross-region queries, token handling, or per-feature SGP interoperability.
csharp-godot
Use when working with C# in Godot — conventions, GodotSharp API differences from GDScript, project setup, and interop.
cloudflare-durable-objects
Cloudflare Durable Objects for stateful coordination and real-time apps. Use for chat, multiplayer games, WebSocket hibernation, or encountering class export, migration, alarm errors.
gamedev-multiplayer
Use when adding multiplayer or netcode to a game — client-server vs P2P, server authority and anti-cheat, state replication vs RPCs, prediction and reconciliation, lag compensation, plus Godot 4 / Unity NGO / Unreal wiring. NOT single-player gameplay (that is godot, unity, unreal), NOT matchmaking or server hosting…
cloudflare-do-turn-based-multiplayer
Design, implement, debug, or verify a remote turn-based multiplayer game whose rooms run on Cloudflare Durable Objects. Use for room and invite identity, reconnectable seats, WebSocket hibernation, concurrent turns, action idempotency, revision conflicts, or cross-browser game-state agreement. Do not trigger for…
roblox-open-cloud
Roblox Open Cloud REST API for accessing data stores, assets, universes, places, users, groups, subscriptions, and Luau execution from outside the engine or via HttpService. Covers authentication (API keys, OAuth 2.0, avoiding legacy cookie auth), scopes and least-privilege, IP allowlists, key rotation and the 60-day…