Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fanfan-de/anybox --skill boxgit clone --depth 1 https://github.com/fanfan-de/anyboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fanfan-de/anybox/box)<a href="https://agentmods.dev/skills/fanfan-de/anybox/box"><img src="https://agentmods.dev/badge/skills/fanfan-de/anybox/box.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.02119 |
| Opus 5 | $0.00045 | $0.01059 |
| Sonnet 5 | $0.00018 | $0.00424 |
| Haiku 4.5 | $0.00009 | $0.00212 |
Grade A, and why
box-content-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Box Content API
Overview
Implement Box content workflows in application code. Reuse the repository's existing auth and HTTP or SDK stack whenever possible, identify the acting Box identity before coding, and make the smallest end-to-end path work before layering on sharing, metadata, webhooks, or AI.
Route The Request
| If the user needs... | Primary object | Read first | Pair with | Minimal verification |
|---|---|---|---|---|
| Local verification, manual smoke tests, or quick inspection from Codex without app code changes | Current CLI environment | references/box-cli.md |
references/auth-and-setup.md |
scripts/box_cli_smoke.py check-auth then a read command |
| Uploads, folders, listings, downloads, shared links, collaborations, or metadata | File or folder | references/content-workflows.md |
references/auth-and-setup.md |
Read-after-write call using the same actor |
| Organizing, reorganizing, or batch-moving files across folders; bulk metadata tagging; migrating folder structures | File set or folder tree | references/bulk-operations.md |
references/auth-and-setup.md, references/content-workflows.md, references/ai-and-retrieval.md |
Inventory source, verify move count matches plan |
| Event-driven ingestion, new-file triggers, or webhook debugging | Webhook or events feed | references/webhooks-and-events.md |
references/auth-and-setup.md, references/troubleshooting.md |
Signature check plus duplicate-delivery test |
| Search, document retrieval, summarization, extraction, or Box AI | Search result set or file content | references/ai-and-retrieval.md |
references/auth-and-setup.md |
Retrieval-quality check before answer formatting |
| 401, 403, 404, 409, 429, missing content, or wrong-actor bugs | Existing request path | references/troubleshooting.md |
references/auth-and-setup.md |
Reproduce with the exact actor, object ID, and endpoint |
| Unsure which workflow applies | Unknown | references/workflows.md |
references/auth-and-setup.md |
Choose the smallest Box object/action pair first |
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 327 B
- examples/box-content-api-prompts.md 879 B
- README.md 2.4 KB
- references/ai-and-retrieval.md 5.5 KB
- references/auth-and-setup.md 4.4 KB
- references/box-cli.md 2.9 KB
- references/bulk-operations.md 11 KB
- references/content-workflows.md 5.1 KB
- references/troubleshooting.md 4.4 KB
- references/webhooks-and-events.md 1.6 KB
- references/workflows.md 1.5 KB
- scripts/box_cli_smoke.py 7.6 KB runs code
- scripts/box_rest.py 12 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 107 lines · 90 tokens per session scan A cb10b6253b83
box-content-api is a skill published in the GitHub repository fanfan-de/anybox (57 stars, last pushed 24d ago), licensed MIT. It adds 90 tokens to every session and 2,119 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
feature-flag-policy
Cargo feature flags for crates/xberg — ORT-incompatible targets (WASM, Android x8664 emulator), type-only and tract inference companion features, WASM/Android-safe variants, PDF backend, mutually-exclusive ORT variants, platform-conditional deps, aggregate feature sets, and build profiles. Load when adding, wiring, or…
ocr-pipeline-and-quality
Change or evaluate Xberg OCR backends, preprocessing, caching, page acceptance, geometry, hOCR structure, table reconstruction, or cross-backend quality. Load for OCR behavior and A/B quality work, not ordinary PDF text extraction.
pdf-backends
Change or diagnose Xberg PDF extraction, native/Pdfium backend selection, PDF rendering sessions, encrypted documents, OCR fallback, or backend-specific capability gaps. Load for PDF engine work, not generic image OCR.
add-sharepoint
Adds SharePoint Online connector to a Power Apps code app. Use when reading lists, managing documents, or integrating with SharePoint sites. Can also create new SharePoint lists.
using-the-mcp-server
Use when converting HTML to Markdown or extracting metadata and tables through the html-to-markdown MCP server's tools, rather than shelling out to the CLI. Covers the tool surface, the auto-installing launcher, and when MCP beats the CLI or SDK.
nw-diagram
Generates C4 architecture diagrams (context, container, component) in Mermaid or PlantUML. Use when creating or updating architecture visualizations.