Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add eph5xx/surfskills.surf --skill surf-skill-publishgit clone --depth 1 https://github.com/eph5xx/surfskills.surfWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eph5xx/surfskills.surf/surf-skill-publish)<a href="https://agentmods.dev/skills/eph5xx/surfskills.surf/surf-skill-publish"><img src="https://agentmods.dev/badge/skills/eph5xx/surfskills.surf/surf-skill-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eph5xx/surfskills.surf/surf-skill-publish"><img src="https://agentmods.dev/badge/skills/eph5xx/surfskills.surf/surf-skill-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.00964 |
| Opus 5.5 | $0.00028 | $0.00386 |
| Sonnet 5.5 | $0.00014 | $0.00193 |
| Haiku 4.5 | $0.00007 | $0.00096 |
Grade A, and why
surf-skill-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Step 6: Publish
Upload the card's video and cover, and write the card into the catalog with its day. Nothing goes live in this step: each skill has its own day (one skill per day), and the public read policy hides it until midnight in Yerevan on that day.
- Reads:
pick.json,card.json,video.json,video/. - Writes: the video and cover in R2, one row in
skills(plus one incollectionsfor a new repo), and lastpublish.json(publish.schema.json).
You are the publisher: one agent, one card. The script does all of it. There is no approval wait.
Run the script from this skill's folder.
What to do
- Publish (code). Run
node scripts/publish.mjs <card>. It checks the inputs, picks the day, uploads the media, writes the rows and writespublish.json. - Reply. Reply with its last line.
To see what it would do without writing anything, add --dry-run. It prints the rows, the day and the R2 names, and makes no uploads, no inserts and no publish.json.
What the script does
- Checks.
card.jsonandvideo.jsonmust match their schemas. The video and cover must sit inside the card folder: the video an.mp4under 5 MB, the cover a.jpg,.pngor.webpunder 2 MB. The skill must not be live yet (its day must not be today or earlier). - Collection. If the repo isn't in the catalog (live or scheduled), it builds a collection row from
card.collectionand GitHub (author, license, stars, last push, homepage) and inserts it. Itsskillslist holds every skill in Pick's copy of the repo atpick.commit. Existing collections are never updated, andcard.collectionis ignored for them. A collection shows on the site once one of its skills is live. - Rows. The skill and collection rows match the live ones field for field (install sentences,
reference_file, emptytoolsandrelated_slugs). The skill row also getsdayandcreated_atset to midnight of that day in Yerevan, so "New" and "Newest" count from go-live. - Media. Uploaded to the
surfskills-mediabucket asskills/<slug>-demo-<sha8>.<ext>, with a year-long immutable cache header. The hash is of the file, so a rerun reuses the same name and skips files already there. Both URLs must answer 200 before the row is written. - Day. The first day after today (Yerevan time) that no skill holds. If another run takes that day first, it moves on to the next free one.
- Already scheduled. The row is updated in place and keeps its day, so a card can be fixed before its day.
- Keys. Reads and writes use the Supabase secret key, which sees scheduled rows:
SUPABASE_SECRET_KEYfrom the environment or.dev.vars, else fetched from the Supabase CLI login and kept in memory. R2 uploads use thewranglerlogin.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +1 tokens per session b0cbd50a6c4c
- 5d ago First seen · 52 lines · 70 tokens per session scan A 9ce79ac83ce4
surf-skill-publish is a skill published in the GitHub repository eph5xx/surfskills.surf (2 stars, last pushed 4d ago), licensed MIT. It adds 71 tokens to every session and 964 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-31.
Other skills, from other repositories
google-drive
Interact with Google Drive - search files, find folders, list contents, download files, upload files, create folders, move, copy, rename, and trash files. Use when user asks to: search Google Drive, find a file/folder, list Drive contents, download or upload files, create folders, move files, or organize Drive…
imagen
Generate images using Google Gemini's image generation capabilities. Use this skill when the user needs to create, generate, or produce images for any purpose including UI mockups, icons, illustrations, diagrams, concept art, placeholder images, or visual representations.
playwright-cli
Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or…
manus
Delegate complex, long-running tasks to Manus AI agent for autonomous execution. Use when user says 'use manus', 'delegate to manus', 'send to manus', 'have manus do', 'ask manus', 'check manus sessions', or when tasks require deep web research, market analysis, product comparisons, stock analysis, competitive…
playwright-frontend
For frontend engineers authoring UI — how to make components reliably locatable by tests and AI agents. Covers the official Playwright locator priority, semantic/accessible markup first, and how to add valid, unique, stable data-testid attributes (naming convention, uniqueness in lists, stability rules) for React…
idea-forge
Run any raw idea through a multi-stage R&D pipeline that interprets, expands, scores, and converts it into an actionable engineering plan. Always trigger immediately when the user's message starts with "idea". Also trigger on "ideaforge", "analyze this idea", "expand this concept", "assess this invention", "explore…