Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dkadts/landing-kit-building --skill inboxgit clone --depth 1 https://github.com/dkadts/landing-kit-buildingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dkadts/landing-kit-building/inbox)<a href="https://agentmods.dev/skills/dkadts/landing-kit-building/inbox"><img src="https://agentmods.dev/badge/skills/dkadts/landing-kit-building/inbox/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dkadts/landing-kit-building/inbox"><img src="https://agentmods.dev/badge/skills/dkadts/landing-kit-building/inbox.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00806 |
| Opus 5 | $0.00019 | $0.00403 |
| Sonnet 5 | $0.00008 | $0.00161 |
| Haiku 4.5 | $0.00004 | $0.00081 |
Grade A, and why
inbox scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/inbox
First pass over client materials. Does not convert (that's /media), does not analyze text (that's /copy-analyze) — only sorts and validates.
When to use
- Client says "materials uploaded".
- After a new batch arrives (top-up).
Process
Step 1. Read brief/08-content-pipeline.md
Load requirements: naming, formats, sizes.
Step 2. Walk inbox/ folders
For each folder (texts/, media/photos/, media/videos/, brand/logo/, brand/fonts/, notes/):
- List files.
- Verify: naming ASCII? correct format? size within limits?
- Mark: ✅ OK / ⚠️ warning / ❌ reject.
Step 3. Specific checks
texts/:
- UTF-8?
- Section headings present (
# Hero,# Offer)?
media/photos/:
- Min side ≥ 2400px (read via image tool or
identify). - sRGB (not Adobe RGB — otherwise color shift in the browser).
- ASCII filenames.
- No
IMG_1234.jpg.
media/videos/:
- 1080p+.
- Bitrate ≤ 20 Mbps.
- H.264 in MP4 (not HEVC — poor browser support).
brand/logo/:
- SVG only.
- Text outlined (check: is there a
<text>tag inside SVG — if yes, NOT outlined). - No embedded raster (no
<image>inside).
brand/fonts/:
.woff2only.LICENSE.txtpresent.
notes/:
- List with type (audio / image / md / other).
- Transcribe voice notes (if possible).
Step 4. Produce the report
Create/update inbox/inbox-report.md:
# Inbox report — 2026-08-08
## Overall
- Files total: N
- OK: N | Warning: N | Reject: N
## texts/
- `copy.md` — ✅ OK (UTF-8, 5 sections)
- `about.docx` — ⚠️ convert to MD
## media/photos/
- `hero-01.jpg` — ✅ 3600×2400, sRGB
- `IMG_1234.jpg` — ❌ rename to ASCII
- `founder.tif` — ⚠️ 6000×4000 > 6000px — will be cropped
## brand/logo/
- `logo.svg` — ❌ text not outlined (found <text>)
## Summary for the client
### Ready
- Texts can go to /copy-analyze
- Hero photo (after rename)
### Needs rework
- 3 photos: rename
- Logo: outline (in Illustrator: Type → Create Outlines)
- `about.docx`: convert to MD
## Next
- Wait for client rework
- OR if user says "ship with what we have" — run /media on ok-files and /copy-analyze on texts
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 109 lines · 38 tokens per session scan A 078aeb48c4dc
inbox is a skill published in the GitHub repository dkadts/landing-kit-building (2 stars, last pushed 21d ago), licensed MIT. It adds 38 tokens to every session and 806 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
next-upgrade
Upgrade Next.js to the latest version following official migration guides and codemods.
deploy
Ship a build reversibly — to a host you manage or a platform that manages it. Pick the topology first, keep the previous version reachable, gate on health, roll back without rebuilding. Use when shipping anywhere users can reach.
regenerate-api
Regenerate the AppointMe frontend API client (orval/TanStack Query hooks + TypeScript schemas) after the backend OpenAPI surface changes. Use this whenever backend endpoints, request/response DTOs, or other contract-affecting types are added, removed, or modified — e.g. after editing files under src/AppointMe.Api…
db-migration
Apply schema migrations safely: detect the tool, classify the change by risk, gate destructive ones behind approval, back up in prod, preview-apply-verify, roll back on failure. Use when a schema change is about to be applied to any environment.
dependency-audit
Dependency risk assessment, read-only: known CVEs, deprecated packages, licence compliance, maintenance status, lockfile integrity, and a justification for every new dependency. Acting on it is dependency-upgrade.
verify
Build, launch, and drive the AppointMe stack to verify a change end-to-end at its runtime surface.