Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gaimsdevsoftware/glaze-coder/glaze-byok-ainpx skills add GaimsDevSoftware/glaze-coder --skill glaze-byok-aigit clone --depth 1 https://github.com/GaimsDevSoftware/glaze-coderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gaimsdevsoftware/glaze-coder/glaze-byok-ai)<a href="https://agentmods.dev/skills/gaimsdevsoftware/glaze-coder/glaze-byok-ai"><img src="https://agentmods.dev/badge/skills/gaimsdevsoftware/glaze-coder/glaze-byok-ai.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00112 | $0.04524 |
| Opus 5 | $0.00056 | $0.02262 |
| Sonnet 5 | $0.00022 | $0.00905 |
| Haiku 4.5 | $0.00011 | $0.00452 |
Grade A, and why
glaze-byok-ai scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 328 lines — stays where its author put it; the contents beside it link to each section on GitHub.
User-selectable AI engine for Glaze apps (Glaze AI or BYOK)
Before scaffolding, read the developer's saved policy if present:
~/.config/glaze-coder/defaults.json with {"aiDefault": "glaze" | "byok-fallback" | "byok-first"} (written by the Free Coder for Glaze onboarding app).
byok-fallback = Glaze default + auto-fallback on (this skill's default);
byok-first = scaffold with a free engine as the app's default provider and Glaze
never running unasked; glaze = built-in AI only, skip the engine picker. A missing
file means byok-fallback.
Default policy for apps built with glaze-coder: when an app calls AI, the end user gets to pick the engine. Glaze AI works with zero setup but spends the user's Glaze credits; a bring-your-own-key engine is free for them (Gemini has a real free tier); the local Claude Code CLI is free for users who already pay for a Claude subscription. Implement this choice unless the user building the app explicitly wants Glaze-only.
Reference implementation: the News Flow app (ai-provider.ts + claude-cli.ts +
"AI-motor" settings section + onboarding engine step). This file contains everything
needed to reproduce it in any app.
The four engines
| Engine | Cost for the user | Setup | Notes |
|---|---|---|---|
glaze (default) |
Glaze credits | none | Always the default and the fallback |
gemini |
free | paste a free AI Studio key | ~250 calls/day free tier; recommended free option |
openrouter |
free | paste an OpenRouter key | ~50 calls/day unfunded; openrouter/free auto-routes; optional third choice |
claude |
free with a Claude subscription | Claude Code installed + logged in | For users known to have Claude Code; settings-only, slower (seconds to a minute per call) |
Rules that keep this correct and honest:
- Glaze stays the default. A missing or invalid BYOK key must silently fall back to Glaze AI, never break the feature.
- Keep
glaze.capabilities.aideclared inpackage.json(grades matching the code), since Glaze remains default + fallback. Publish rejects AI apps without it. - Keys are encrypted with
safeStorage, stored in userData, and never sent to the renderer. Only booleanhasKeyflags cross IPC. - Key links: Gemini keys at
https://aistudio.google.com/apikey, OpenRouter keys athttps://openrouter.ai/settings/keys. Open viashell.openExternal. Automatic key provisioning is not possible; a deep link plus paste field is the simplest flow. - The "Test" button makes one tiny
generateTextcall against the user's own key, only when clicked. Never run it (or any AI call) yourself during verification; verify with type-check and build only. - Do not put pricing copy next to AI controls beyond the engine descriptions; Glaze's own consent UI explains credits.
- The Claude engine spawns the user's own
claudeCLI (subscription login). Never collect Anthropic API keys, OAuth tokens, or Claude credential files for it, and never persistCLAUDE_CODE_OAUTH_TOKEN. Offer it to audiences known to have Claude Code; keep it in full settings, not onboarding. Detection gates the UI state (a found/not-found badge), and a missing CLI falls back to Glaze like a missing key.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 328 lines · 112 tokens per session scan A 3f56ff22b282
glaze-byok-ai is a skill published in the GitHub repository GaimsDevSoftware/glaze-coder (8 stars, last pushed 14d ago), licensed MIT. It adds 112 tokens to every session and 4,524 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
raycast
Comprehensive operational skill specification for Anthropic Claude to automate, script, troubleshoot, and optimize Raycast, React/TypeScript Extension API (@raycast/api), Script Commands, and URL schemes.
raycast
Best practices and workflows for developing and modifying Raycast Extensions (React/Node). Use when the user asks to create, update, or troubleshoot a Raycast extension, whether it interfaces with external APIs (Notion, Spotify) or executes local scripts (AppleScript, Keyboard Maestro).
frame-macos-notification
拟真 macOS 通知 banner + app icon + 标题正文, 适合 video overlay / 产品发布预告.
commit-push-pr
Commit selected local changes, push the branch, and create or update a GitHub pull request with BitFun attribution. Use when the user asks to 提交 PR、提代码、commit and push、开 PR、create a pull request, or wants a Claude Code-like one-command PR publishing flow from BitFun.
triage-issue-local
Repo-specific triage guidance for warp. Only the categories declared overridable by the core triage-issue skill may be specialized here.
release-peekaboo
Peekaboo release: notarization, npm/GitHub release, appcast, verify, closeout.