Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fabioc-aloha/Alex_Skill_Mall --skill mall-self-curationgit clone --depth 1 https://github.com/fabioc-aloha/Alex_Skill_MallWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mall-self-curation)<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mall-self-curation"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mall-self-curation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mall-self-curation"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mall-self-curation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.03013 |
| Opus 5 | $0.00028 | $0.01507 |
| Sonnet 5 | $0.00011 | $0.00603 |
| Haiku 4.5 | $0.00006 | $0.00301 |
Grade A, and why
mall-self-curation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mall Self-Curation
The Plugin Mall is self-curating. Day-to-day operations (inventory, scoring, catalog publishing, staleness pruning) run inside this repo's .github/workflows/scan-sources.yml. This skill is the operational playbook for that pipeline.
When to Use
- Authoring or debugging anything under
scripts/scan-sources.cjs/normalize-frontmatter.cjs/compute-trust.cjs/list-refs.cjs/render-catalog.cjs - Weekly catalog-refresh PR (
catalog-refresh/YYYY-MM-DD) is stuck or producing surprising deltas - New source added to
sources/supported-stores.json— verifying it flows through the pipeline - New plugin shape encountered (frontmatter convention we haven't seen before)
- Importing or refreshing a first-party plugin with
npm run vendor - Preparing or reviewing a contributor submission with
submit:prepare/submit:validate - Refreshing first-party catalog state with
npm run maintain -- --curated - Onboarding to Mall internals
Canonical operator commands
| Role | Command | Writes | Approval boundary |
|---|---|---|---|
| Maintainer | npm run vendor -- --source <path-or-repo> --category <category> --repository <url> --ref <tag-or-sha> |
None by default | Dry-run; add --apply, and --replace for existing plugins |
| Maintainer | npm run maintain -- --curated |
First-party catalog, trust, marketplace, README, rendered pages | Review git diff before commit |
| Maintainer | npm run maintain -- --full |
Full registered-store catalog surface | Requires SOURCES_DIR and GitHub auth |
| Contributor | npm run submit:prepare -- ... --apply |
Proposed plugin payload + marketplace entry in contributor branch | Never commits, pushes, merges, or approves |
| Contributor / CI | npm run submit:validate -- --plugin <category>/<name> |
None | Structural eligibility only; CODEOWNER decides acceptance |
All plugin packaging routes through scripts/lib/plugin-package.cjs. Do not
author a second copier or validator for one plugin. The shared library owns
component-path normalization, prompt renaming, metadata generation, secret and
symlink rejection, the 100-file limit, and atomic replacement.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 160 lines · 56 tokens per session scan A d94d5a763e67
mall-self-curation is a skill published in the GitHub repository fabioc-aloha/Alex_Skill_Mall (4 stars, last pushed today), licensed MIT. It adds 56 tokens to every session and 3,013 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
apply-cross-functional-leadership
Use when a manager needs to lead a project or initiative that depends on team members or stakeholders they do not formally manage — to build voluntary cooperation, alignment, and momentum across organizational boundaries through influence rather than authority.
build-psychological-safety
Use when a team leader wants to assess and improve the degree to which team members feel safe to speak up, admit mistakes, ask questions, and disagree — because psychological safety is the strongest predictor of team learning and high performance.
run-performance-improvement-plan
Use when a direct report has a documented pattern of performance falling below role expectations — after informal feedback has not produced sustained change — to create a structured, time-bound plan with clear success criteria before making a continuation decision.
run-underperformance-conversation
Use when a manager first observes that a direct report's performance is declining or falling below expectations — to have an early, direct, non-punitive conversation that names the gap and opens a path to correction before the situation requires formal process.
apply-change-leadership
Use when a manager's team is experiencing a significant organizational change — restructuring, strategy shift, leadership change, layoffs, or major process transition — and needs leadership that maintains team stability, preserves trust, and converts uncertainty into direction.
apply-distributed-team-practices
Use when managing a team where members work in different locations, time zones, or on hybrid schedules — to adapt management practices so remote members have equal access to information, relationships, and advancement opportunities as in-office members.