Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/duthaho/skillhub/newskillnpx skills add duthaho/skillhub --skill newskillgit clone --depth 1 https://github.com/duthaho/skillhubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/duthaho/skillhub/newskill)<a href="https://agentmods.dev/skills/duthaho/skillhub/newskill"><img src="https://agentmods.dev/badge/skills/duthaho/skillhub/newskill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00055 | $0.01265 |
| Opus 5 | $0.00028 | $0.00633 |
| Sonnet 5 | $0.00011 | $0.00253 |
| Haiku 4.5 | $0.00006 | $0.00127 |
Grade A, and why
newskill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
newskill — add a skill without drift
/newskill scaffold <name> "<description>" <category> — create a new skill, registered
/newskill fix [<name>] — complete a skill that exists in some surfaces but not others
A skillhub skill lives in four surfaces, and it is only really "added" when all four agree:
- Folder —
.claude/skills/<name>/SKILL.mdwith valid frontmatter. - README table row — a row in the right category table (a prose mention does not count; the validator checks for a table row specifically).
- Marketplace —
<name>listed in one plugin'sskills[]in.claude-plugin/marketplace.json. - Trigger evals — cases in
evals/triggers.json(model-invoked skills only; user-invoked skills are exempt).
Drift is these four disagreeing — the default failure of hand-adding a
skill. The oracle for drift is python3 scripts/validate-skills.py: it already
reports which surfaces are missing. This skill's whole job is to make the four
agree and leave the validator green.
The loop (both modes end here)
Run python3 scripts/validate-skills.py → read each FAIL/WARN → fix that exact
surface → re-run. Repeat until no FAIL. Never assert done from memory; the
validator is cheap and authoritative.
Mode: scaffold
Adding a brand-new skill from a name + description + category.
- Guard. If
.claude/skills/<name>/already exists, stop — this is afix, not a scaffold; never overwrite an existingSKILL.md. Also reject a<name>that collides with a harness built-in (the validator'sBUILTINSset) or an existing skill. - Folder. Write
.claude/skills/<name>/SKILL.mdwith frontmatter (name= folder name) and adescription. Ifout/tune/principles.mdexists, read it before writing the body — each line is an authoring rule distilled from accepted past fixes. Keep the description ≤ 950 chars (soft limit; hard wall is 1024) — front-load the leading word, one trigger per branch. For a user-invoked tool adddisable-model-invocation: trueand write a human-facing one-line description (no trigger list). - Category → plugin + table.
<category>is one ofcoding-loop/research/daily. Add./.claude/skills/<name>to that plugin'sskills[]inmarketplace.json, and add one row to the matching README category table. - Trigger evals (model-invoked only). Add ≥2 cases to
evals/triggers.json, including a routing pair against the nearest neighbour skill. Skip for user-invoked skills. - Pre-flight the body's snippets. Every snippet the new
SKILL.mdembeds is tried once against real data before the skill ships, output quoted in-session: execute each bash line (placeholders filled with real values), fetch each API endpoint, read each referenced path. A snippet that fails as written is a bug in the skill, not a formatting nit. Two honest outs, both flagged unverified and never skipped silently: one that can't run here (external account, missing binary, a file that exists only mid-run), and one that would mutate real state — never run something destructive just to prove it. This is tune's prove-the-rules-bite extended from config to authoring. (Fix mode is exempt — it never writes a body.) - Run the loop above until green.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 99 lines · 55 tokens per session scan A 437a5dc47673
newskill is a skill published in the GitHub repository duthaho/skillhub (9 stars, last pushed 11d ago), licensed MIT. It adds 55 tokens to every session and 1,265 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
auto-loop
TDD-based autonomous development loop with checkpoint recovery and observability changelog.
hook-template
Generate hook script from template. Use when adding a new hook, wiring a PreToolUse/PostToolUse/Stop/Notification hook, or scaffolding hook config for settings.json.
agent-check
Validate custom agent file format and structure. Use after creating or editing an agent, before committing agent changes, or when an agent fails to load.
session-relay
Continue real repository work between Claude Code, Codex CLI, and Grok Build with a privacy-bounded, drift-aware handoff packet. Use for cross-vendor takeover, context-limit checkpoints, multi-hop Claude→Codex→Grok relays, or receiving an existing Director packet. Use native resume commands for same-CLI history; never…
skill-check
Validate skill/command file format and structure. Use after creating or editing a skill, before committing skill changes, or when a skill fails to load or trigger.
skill-template
Generate custom skill/command from template. Use when creating a new skill or slash command from scratch, or scaffolding a skill file with correct frontmatter.