elizaOS is an open-source TypeScript framework and product stack for building and running autonomous AI agents. Developers use its runtime, application, command-line tool, cloud services, native bridges, and plugins to create agent-based software. The catalogue entries provide skills, commands, instructions, and rules for working with this monorepo and its agent ecosystem.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add elizaOS/eliza --skill eliza-cloud-buy-domaingit clone --depth 1 https://github.com/elizaOS/elizaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/elizaos/eliza/eliza-cloud-buy-domain)<a href="https://agentmods.dev/skills/elizaos/eliza/eliza-cloud-buy-domain"><img src="https://agentmods.dev/badge/skills/elizaos/eliza/eliza-cloud-buy-domain/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/elizaos/eliza/eliza-cloud-buy-domain"><img src="https://agentmods.dev/badge/skills/elizaos/eliza/eliza-cloud-buy-domain.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk fail
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 118 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.01613 |
| Opus 5 | $0.00063 | $0.00807 |
| Sonnet 5 | $0.00025 | $0.00323 |
| Haiku 4.5 | $0.00013 | $0.00161 |
Grade A, and why
eliza-cloud-buy-domain scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Buy a domain for your app on Eliza Cloud
Use this skill when an Eliza Cloud app needs a real custom domain (e.g. myapp.com) instead of the auto-assigned *.apps.eliza.app subdomain.
The cloud handles everything: domain availability check, registration through cloudflare, DNS pointing at your app's container, and attachment to your app record. You pay from your existing cloud credit balance — no separate cloudflare account, no manual DNS config, no credit card paste.
Status — shipped end to end. Custom-domain buy layers on top of the live app build + monetize flow and is offered only after an app is live (never as the first step). The buy money-path is hardened — atomic with refund-on-registration-failure and purchase idempotency (#10244, #10247) — and the CNAME origin last-mile (#10245) and renewal billing cron (#10246) are live. Always confirm the price and get an explicit user "yes" before any buy; never auto-buy.
In a conversational agent, prefer the first-class actions. An agent running
@elizaos/plugin-cloud-appsalready hasCHECK_APP_DOMAIN(availability + price quote),BUY_APP_DOMAIN(two-phase confirm with a quote TTL; maps the idempotent-buy / refund / no-charge-recovery outcomes to honest replies), andLIST_APP_DOMAINS— use those instead of raw SDK calls from chat. The SDK flow below is for orchestrated workers and custom code.
Prerequisites
- An app registered on Eliza Cloud (use
build-monetized-appfirst if you haven't shipped one yet) - Enough cloud credit balance to cover the domain (cloudflare wholesale + a fixed eliza cloud margin; a
.comis roughly $14–15 USD/year) - Either the parent-agent Cloud command bridge in an orchestrated worker, or
ELIZAOS_CLOUD_API_KEYin the parent/app runtime. Do not pass wallet private keys or owner Cloud API keys into a spawned child process.
Default flow
import { ElizaCloudClient } from "@elizaos/cloud-sdk";
const cloud = new ElizaCloudClient({
apiKey: process.env.ELIZAOS_CLOUD_API_KEY,
// optional override for local dev / staging / preview deploys.
// unset in prod → SDK uses eliza.app for browser flows and api.eliza.app for API calls
baseUrl: process.env.ELIZA_CLOUD_BASE_URL,
});
// 1. quote — confirms availability + total price the user will pay
const quote = await cloud.routes.postApiV1AppsByIdDomainsCheck({
pathParams: { id: appId },
json: { domain: "myapp.com" },
});
if (!quote.available) {
// try a different domain or pick an alternate TLD
return;
}
const totalUsd = quote.price.totalUsdCents / 100;
// 2. confirm with the user (one-line ack is enough; the SDK will throw
// if the org balance is insufficient)
//
// "buying myapp.com for $14.95 from your cloud balance — ok?"
// 3. buy — atomic on the cloud side: debit credits → register via cloudflare
// → write managed_domains row + attach to app → CNAME the new zone at
// the app's container url. Refunds credits if registration fails. If the
// domain is already owned by this org, this returns alreadyRegistered
// without charging again.
const result = await cloud.routes.postApiV1AppsByIdDomainsBuy({
pathParams: { id: appId },
json: { domain: "myapp.com" },
});
// 4. (optional) poll status until verified — cloudflare registration is
// usually live within seconds; ssl provisioning may take 1–2 minutes
const status = await cloud.routes.postApiV1AppsByIdDomainsStatus({
pathParams: { id: appId },
json: { domain: "myapp.com" },
});
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 120 lines · 125 tokens per session scan A 8e291f4ab1c4
eliza-cloud-buy-domain is a skill published in the GitHub repository elizaOS/eliza (19,326 stars, last pushed today), licensed MIT. It adds 125 tokens to every session and 1,613 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deliveroo-order
Turn collected lunch orders into a clean per-person order list for a human to place on Deliveroo. Use in step 2 of the lunch run, after orders are collected. The live menu is fetched automatically by the lobu-team-lunch-finalize reaction (via the Owletto Chrome extension) — this skill never places an order or touches…
music-catalog
A lookup tool for a built-in, fixed catalogue of singers and songs. It can answer only from the catalogue included with the skill.
payram-checkout-integration
Integrate PayRam checkout flow into web applications. Generate payment links, embed payment pages, handle redirects, and process payment confirmations. Supports Express, Next.js, FastAPI, Laravel, Gin, Spring Boot. Use when adding crypto checkout to e-commerce, building payment forms, implementing deposit flows, or…
payram-widget-integration
Integrate the PayRam Add Credit widget (payram-add-credit-v1.js) into a website or web app. Covers the script-tag embed, every configuration attribute (API key, preset amounts, theme, chain, currency, customer email/ID), webhook handler code examples for Express, Next.js API routes, FastAPI, Laravel, and Gin, webhook…
payram-payment-integration
Integrate crypto payments into any web application with PayRam. Self-hosted payment gateway — no KYC, no signup, no third-party custody. Accept USDT, USDC, Bitcoin, ETH in under 10 minutes. Works with Express, Next.js, FastAPI, Laravel, Gin, Spring Boot. Drop-in replacement for Stripe/PayPal for crypto. Use when…
food-order
Reorder Foodora orders + track ETA/status with ordercli. Never confirm without explicit user approval. Triggers: order food, reorder, track ETA.