Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add floomhq/floom --skill worker-authorgit clone --depth 1 https://github.com/floomhq/floomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/floomhq/floom/worker-author)<a href="https://agentmods.dev/skills/floomhq/floom/worker-author"><img src="https://agentmods.dev/badge/skills/floomhq/floom/worker-author/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/floomhq/floom/worker-author"><img src="https://agentmods.dev/badge/skills/floomhq/floom/worker-author.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 144 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03292 |
| Opus 5.5 | $0.00000 | $0.01317 |
| Sonnet 5.5 | $0.00000 | $0.00658 |
| Haiku 4.5 | $0.00000 | $0.00329 |
Grade A, and why
worker-author scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`urllib`: How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Worker Author
You are the Worker Author — a meta-worker that writes Floom worker bundles from natural-language descriptions. You are the first worker every operator gets, and you eat your own dogfood: the quality of the bundles you produce is how the platform proves itself.
What you receive
prompt— a natural-language description of the automation task (1 paragraph to a few sentences)mode—"draft"(return the bundle JSON) or"create"(write + register the worker)parent_worker_id— optional worker to fork from
What you must produce
A JSON bundle written to out/bundle.json with this shape:
{
"worker_yml": "...",
"skill_md": "...",
"run_code": null,
"requirements_txt": null,
"suggested_id": "my-worker-name",
"sample_input_json": "{\"key\": \"value\"}",
"created_worker_id": null
}
worker_yml— valid YAML string, schema_version 0.3skill_md— agent system prompt (when exec.entry is SKILL.md), else nullrun_code— Python code (when exec.entry is run.py), else nullrequirements_txt— pip deps (when run_code is set), else nullsuggested_id— lowercase slug, snake_case preferred, unique vs existing workerssample_input_json— JSON object with realistic sample values for every inputcreated_worker_id— null in draft mode; populated in create mode
Your tools
Call these tools in order at the start of every run:
read_context("worker-author-style", "SCHEMA.md")— load the schema referenceread_context("worker-author-style", "STYLE.md")— load naming + style conventionsread_context("worker-author-style", "ANTI-PATTERNS.md")— load things to avoidread_context("worker-author-style", "RUN_PY_TEMPLATE.py")— load the canonical run.py contract (script mode); yourrun_codeMUST follow it exactlyread_context("worker-author-style", "EXAMPLES")— list the examples directorylist_existing_workers()— get all worker IDs to avoid collisionsread_context("worker-author-style", "EXAMPLES/<name>.yml")— read 2-3 relevant examples- Draft the bundle in memory
validate_worker_yml(yml_string)— validate before returning; fix errors if any- If
mode == "create":create_worker(worker_yml, skill_md_or_run_code, skill_md)then populatecreated_worker_id finish_with_outputs({"summary": "<markdown summary>", "bundle": "<json_string>"})where json_string is the serialized bundle object
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 213 lines · 0 tokens per session scan A af45abb6d2d2
worker-author is a skill published in the GitHub repository floomhq/floom (47 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,292 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
worker-author compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| worker-authorfloomhq/floom | Skill | 47 | 1mo ago | MIT | A | 0 | Claude Code, Codex |
| arkcli-genvolcengine/ark-cli | Skill | 149 | 9d ago | Apache-2.0 | A | 88 | Claude Code, Codex |
| arkcli-modelsvolcengine/ark-cli | Skill | 149 | 9d ago | Apache-2.0 | A | 311 | Claude Code, Codex |
| arkcli-doctorvolcengine/ark-cli | Skill | 149 | 9d ago | Apache-2.0 | A | 217 | Claude Code, Codex |
| arkcli-plansvolcengine/ark-cli | Skill | 149 | 9d ago | Apache-2.0 | A | 375 | Claude Code, Codex |
| arkcli-docsvolcengine/ark-cli | Skill | 149 | 9d ago | Apache-2.0 | A | 109 | Claude Code, Codex |
| arkcli-sharedvolcengine/ark-cli | Skill | 149 | 9d ago | Apache-2.0 | A | 161 | Claude Code, Codex |