Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add eph5xx/surfskills.surf --skill surf-skillgit clone --depth 1 https://github.com/eph5xx/surfskills.surfWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eph5xx/surfskills.surf/surf-skill)<a href="https://agentmods.dev/skills/eph5xx/surfskills.surf/surf-skill"><img src="https://agentmods.dev/badge/skills/eph5xx/surfskills.surf/surf-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eph5xx/surfskills.surf/surf-skill"><img src="https://agentmods.dev/badge/skills/eph5xx/surfskills.surf/surf-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.00997 |
| Opus 5.5 | $0.00040 | $0.00399 |
| Sonnet 5.5 | $0.00020 | $0.00199 |
| Haiku 4.5 | $0.00010 | $0.00100 |
Grade A, and why
surf-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Surf Skill: skill of the day
All six steps are built. Publish writes each card into the catalog with its own future day; it goes live at midnight in Yerevan on that day. The site doesn't show the day yet.
You are the orchestrator. You build cards one after another until the batch is done or something goes wrong. You never do a step's work yourself and never open a step's files. Run scripts from this skill's folder.
Rules
- Stop at the first problem. Anything other than an
ok:reply with a passing check stops the batch. Log it, then tell the owner in the chat which card, which step and why. Don't ask the user anything while things are going fine. - Never retry, never rerun. Don't launch a step again after it failed, and don't rerun a step that already finished. Only the owner decides that.
- Never fix anything yourself. No workarounds, no editing a card's files, no patching scripts. Report and stop.
- One fresh sub-agent per step (in Claude Code, the Agent tool). Its prompt is two absolute paths: the step skill's SKILL.md and the card folder. Pick gets only its SKILL.md.
- Trust the check, not the reply. A step passed only when it replied
ok:andnode scripts/state.mjs check <card> <step>printsok. - Log every step:
node scripts/state.mjs log <card> <step> <done|failed|dropped|blocked> "<why>". Use-as the card for Pick before it has one. - Owner-only commands.
node scripts/state.mjs resume <card>andnode scripts/state.mjs skip <card>clear a stop. Run them only when the owner asks.
Input
Batch size: how many cards to publish. Default 7.
Steps
Each step is its own skill, in a sibling folder of this one.
- Pick: surf-skill-pick
- Plan: surf-skill-plan
- Run: surf-skill-run
- Card: surf-skill-card
- Video: surf-skill-video
- Publish: surf-skill-publish
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +10 lines · +10 tokens per session ca41ffb3c6ed
- 5d ago First seen · 56 lines · 89 tokens per session scan A a9dbfcffe0db
surf-skill is a skill published in the GitHub repository eph5xx/surfskills.surf (2 stars, last pushed 4d ago), licensed MIT. It adds 99 tokens to every session and 997 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-31.
Other skills, from other repositories
google-drive
Interact with Google Drive - search files, find folders, list contents, download files, upload files, create folders, move, copy, rename, and trash files. Use when user asks to: search Google Drive, find a file/folder, list Drive contents, download or upload files, create folders, move files, or organize Drive…
imagen
Generate images using Google Gemini's image generation capabilities. Use this skill when the user needs to create, generate, or produce images for any purpose including UI mockups, icons, illustrations, diagrams, concept art, placeholder images, or visual representations.
playwright-cli
Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or…
manus
Delegate complex, long-running tasks to Manus AI agent for autonomous execution. Use when user says 'use manus', 'delegate to manus', 'send to manus', 'have manus do', 'ask manus', 'check manus sessions', or when tasks require deep web research, market analysis, product comparisons, stock analysis, competitive…
playwright-frontend
For frontend engineers authoring UI — how to make components reliably locatable by tests and AI agents. Covers the official Playwright locator priority, semantic/accessible markup first, and how to add valid, unique, stable data-testid attributes (naming convention, uniqueness in lists, stability rules) for React…
idea-forge
Run any raw idea through a multi-stage R&D pipeline that interprets, expands, scores, and converts it into an actionable engineering plan. Always trigger immediately when the user's message starts with "idea". Also trigger on "ideaforge", "analyze this idea", "expand this concept", "assess this invention", "explore…