Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Emasoft/claude-plugins-validation --skill cpv-marketplace-authoring-contractgit clone --depth 1 https://github.com/Emasoft/claude-plugins-validationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/emasoft/claude-plugins-validation/cpv-marketplace-authoring-contract)<a href="https://agentmods.dev/skills/emasoft/claude-plugins-validation/cpv-marketplace-authoring-contract"><img src="https://agentmods.dev/badge/skills/emasoft/claude-plugins-validation/cpv-marketplace-authoring-contract/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/emasoft/claude-plugins-validation/cpv-marketplace-authoring-contract"><img src="https://agentmods.dev/badge/skills/emasoft/claude-plugins-validation/cpv-marketplace-authoring-contract.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01213 |
| Opus 5 | $0.00026 | $0.00607 |
| Sonnet 5 | $0.00010 | $0.00243 |
| Haiku 4.5 | $0.00005 | $0.00121 |
Grade A, and why
cpv-marketplace-authoring-contract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Marketplace Authoring Contract
Overview
Seven sub-rules make marketplace.json authoring deterministic. Agents internalise them and emit correct entries on the FIRST try; validate_marketplace.py --strict (upstream cross-validation runs unconditionally) becomes a safety net.
Prerequisites
- FS write access to the marketplace.json
validate_marketplace.py --strictrunnable (upstream cross-validation runs unconditionally — no flag needed)- Remote sources: upstream
plugin.jsonreachable via TRDD-c0ee9543 Phase B fetcher
Instructions
Read the seven sub-rules in order:
- name-canonicalisation — entry
nameequals upstream byte-for-byte. - version-strategy — omit on remote, require on local.
- known-fields — closed 15-field allowlist.
- source-shape — per-source field rules.
- layout-decision-tree — count, then same/different repos.
- common-pitfalls — PIT-001..PIT-007.
- preflight-recipe — 4-step preflight.
Copy this checklist and track your progress:
- Step 1 baseline (modify/migrate flows only)
- Step 2 fetch upstream + cross-check
- Layout pinned before drafting
- Source shape matches canonical example
- No PIT-NNN pattern in draft
- Step 3 emit
- Step 4 post-emit validator (exit 0 or known-baseline only)
Output
marketplace.json passing the validator on the FIRST try, zero new findings vs baseline.
Error Handling
| Error | Resolution |
|---|---|
| Upstream fetch fails | Emit placeholder draft; step 4 blocks ship |
| Non-canonical name requested | Refuse via name-canonicalisation.md#refusal-templates |
| Unknown field requested | Refuse via known-fields.md#refusal-patterns |
| Step 4 new finding | Re-enter step 2, fix, re-emit |
| Finding unclear | Stop, ask user |
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 96 lines · 51 tokens per session scan A f49589683578
cpv-marketplace-authoring-contract is a skill published in the GitHub repository Emasoft/claude-plugins-validation (4 stars, last pushed 5d ago), licensed MIT. It adds 51 tokens to every session and 1,213 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
flow-next-impl-review
Carmack-level implementation review of changes via the configured backend. Use when asked to review code or a diff in a flow-next repo.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.
flow-next-tracker-sync
Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.
writing-style
Use for technical communication - GitHub/GitLab tickets, PR/MR descriptions, issue comments, code review comments, commit messages. Direct, brief style with no AI-speak. NOT for README.md, public docs, or blog posts.
flow-next-prime
Assess codebase agent and production readiness. Classifies the project, verifies commands run, leads with a verdict and ranked next actions.
design-sync-upload
An uploader for design-system files such as DESIGN.md, tokens, logos, fonts, and images into Claude Design. It can either use an authenticated connection or prepare a folder and guide for manual upload.