Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ertugrulakben/cashclaw --skill cashclaw-invoicergit clone --depth 1 https://github.com/ertugrulakben/cashclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ertugrulakben/cashclaw/cashclaw-invoicer)<a href="https://agentmods.dev/skills/ertugrulakben/cashclaw/cashclaw-invoicer"><img src="https://agentmods.dev/badge/skills/ertugrulakben/cashclaw/cashclaw-invoicer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ertugrulakben/cashclaw/cashclaw-invoicer"><img src="https://agentmods.dev/badge/skills/ertugrulakben/cashclaw/cashclaw-invoicer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 16 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 26 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 108 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 112 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 119 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 127 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 135 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 139 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 143 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 151 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 155 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 326 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 331 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 347 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 354 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 362 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 326 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.02765 |
| Opus 5 | $0.00017 | $0.01383 |
| Sonnet 5 | $0.00007 | $0.00553 |
| Haiku 4.5 | $0.00003 | $0.00277 |
Grade A, and why
cashclaw-invoicer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
### Using Stripe API Directly (curl) How it starts
The opening of the file, as written. The whole thing — 396 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CashClaw Invoicer
You handle all payment operations for CashClaw. You create invoices, generate payment links, track payment status, and send automated reminders. Every dollar earned must be tracked accurately. This is the skill that turns delivered work into collected revenue.
Prerequisites
- Stripe account with API access enabled.
- STRIPE_SECRET_KEY set in environment or
~/.cashclaw/config.json. - Node.js 18+ installed (for the stripe-ops.js script).
Install the Stripe SDK:
npm install stripe
Invoice Creation
When to Invoice
- Pre-payment model: Create a payment link at ACCEPT stage. Client pays before work begins.
- Post-payment model: Create an invoice at DELIVER stage. Client pays after receiving deliverables.
- Recurring services: Create a Stripe subscription for monthly services (WhatsApp management, social media).
Invoice Data Structure
{
"mission_id": "MISSION-20260223-001",
"client": {
"name": "Acme Corp",
"email": "[email protected]"
},
"items": [
{
"description": "SEO Audit - Standard Tier",
"quantity": 1,
"unit_amount": 2900,
"currency": "usd"
}
],
"due_date": "2026-03-02",
"notes": "Thank you for choosing CashClaw!",
"metadata": {
"mission_id": "MISSION-20260223-001",
"service": "seo-audit",
"tier": "standard"
}
}
Using the stripe-ops.js Script
# Create a payment link
node scripts/stripe-ops.js create-link \
--amount 2900 \
--currency usd \
--description "SEO Audit - Standard" \
--mission "MISSION-20260223-001"
# Create a full invoice
node scripts/stripe-ops.js create-invoice \
--email "[email protected]" \
--amount 2900 \
--currency usd \
--description "SEO Audit - Standard" \
--due-days 7
# Check payment status
node scripts/stripe-ops.js check-status \
--invoice "in_1234567890"
# Send payment reminder
node scripts/stripe-ops.js send-reminder \
--invoice "in_1234567890" \
--template "gentle"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 396 lines · 35 tokens per session scan A a4037ed88292
cashclaw-invoicer is a skill published in the GitHub repository ertugrulakben/cashclaw (300 stars, last pushed 3mo ago), licensed MIT. It adds 35 tokens to every session and 2,765 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
monetization
Estrategia e implementacao de monetizacao para produtos digitais - Stripe, subscriptions, pricing experiments, freemium, upgrade flows, churn prevention, revenue optimization e modelos de negocio SaaS.
polymarket
Query Polymarket prediction market data — search markets, get prices, orderbooks, and price history. Read-only via public REST APIs, no API key needed.
conviction-fm
Compete in daily crypto prediction competitions on conviction.fm. Create AI agents with natural language strategies, enter token pair pools, and climb the leaderboard. Uses MCP to provide tools for pool data, agent creation, position entry, and strategy management.
build-business-case
Review commercial proposals and build customer-led business cases, ROI or value models, pricing or investment rationales, executive summaries, and customer-ready value stories tied to a customer, workflow, initiative, or decision.
fred-economic-data
Query FRED (Federal Reserve Economic Data) API for 800,000+ economic time series from 100+ sources. Access GDP, unemployment, inflation, interest rates, exchange rates, housing, and regional data. Use for macroeconomic analysis, financial research, policy studies, economic forecasting, and academic research requiring…
tinker-training-cost
Calculates training costs for Tinker fine-tuning jobs. Use when estimating costs for Tinker LLM training, counting tokens in datasets, or comparing Tinker model training prices. Tokenizes datasets using the correct model tokenizer and provides accurate cost estimates.