Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add greedychipmunk/agent-skills --skill medusajs-developergit clone --depth 1 https://github.com/greedychipmunk/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greedychipmunk/agent-skills/medusajs-developer)<a href="https://agentmods.dev/skills/greedychipmunk/agent-skills/medusajs-developer"><img src="https://agentmods.dev/badge/skills/greedychipmunk/agent-skills/medusajs-developer.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 476 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 95 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 544 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.03644 |
| Opus 5 | $0.00025 | $0.01822 |
| Sonnet 5 | $0.00010 | $0.00729 |
| Haiku 4.5 | $0.00005 | $0.00364 |
Grade A, and why
medusajs-developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 584 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MedusaJS Developer Agent Skill
An expert agent specializing in MedusaJS v2.15+ development, focusing on building scalable e-commerce solutions with custom modules, API integrations, and third-party plugins.
Core Capabilities
1. Custom Module Development
- Data Models: Create and manage data models using MedusaJS DML
- Module Services: Implement service layers with automatic CRUD operations
- Module Configuration: Set up proper module structure and exports
- Database Migrations: Generate and manage database schema changes
2. API Route Development
- Custom Endpoints: Create REST API routes in
src/api/[route-name]/route.ts - HTTP Methods: Implement GET, POST, PUT, DELETE handlers
- Request/Response Handling: Manage MedusaRequest and MedusaResponse objects
- Authentication: Integrate with MedusaJS auth systems
3. Commerce Module Integration
- 18 Built-in Modules: Work with API Key, Auth, Cart, Customer, Order, Payment, Product, Pricing, Promotion, Tax, and more
- Module Links: Create relationships between different modules
- Custom Fields: Extend existing modules with additional data fields
- Module Composition: Combine multiple modules for complex workflows
4. Workflow & Automation
- Scheduled Jobs: Create recurring tasks with cron expressions
- Event Handling: Implement subscribers for asynchronous operations
- Business Logic: Orchestrate complex commerce workflows
- Background Processing: Handle long-running operations efficiently
5. Third-Party Integrations
- Payment Providers: Integrate custom payment gateways
- External APIs: Connect with shipping, tax, and inventory services
- Webhooks: Handle incoming webhooks from external systems
- Data Synchronization: Sync data with external platforms
Medusa v2.15+ Updates
Auth & Security
- Medusa v2.15+ includes built-in MFA primitives for auth flows.
- Prefer module-managed TOTP, SMS, and recovery code challenges instead of rolling your own OTP storage.
- Wire MFA into the Auth module by treating it as part of sign-in, enrollment, challenge, verify, and recovery flows.
What ships with it
29 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- resources/api-patterns.md 5.8 KB
- resources/commerce-modules.md 10 KB
- resources/integrations-guide.md 17 KB
- resources/module-development.md 11 KB
- resources/testing-patterns.md 19 KB
- resources/workflows-jobs.md 19 KB
- scripts/build-production.sh 923 B runs code
- scripts/create-api-route.sh 3.7 KB runs code
- scripts/create-module.sh 1.7 KB runs code
- scripts/create-scheduled-job.sh 2.2 KB runs code
- scripts/db-setup.sh 378 B runs code
- scripts/dev-server.sh 818 B runs code
- scripts/generate-migration.sh 680 B runs code
- scripts/plugin-build.sh 589 B runs code
- scripts/plugin-develop.sh 501 B runs code
- scripts/predeploy.sh 386 B runs code
- scripts/README.md 5.3 KB
- scripts/rollback-migration.sh 820 B runs code
- scripts/run-migrations.sh 605 B runs code
- scripts/run-tests.sh 1.2 KB runs code
- scripts/setup-testing.sh 2.4 KB runs code
- scripts/start-production.sh 800 B runs code
- templates/api-route-complete.ts 11 KB runs code
- templates/module-complete.ts 6.8 KB runs code
- templates/module-link.ts 12 KB runs code
- templates/README.md 9.2 KB
- templates/scheduled-job.ts 13 KB runs code
- templates/subscriber-complete.ts 12 KB runs code
- templates/workflow-complete.ts 12 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 584 lines · 50 tokens per session scan A f141076d0aa4
medusajs-developer is a skill published in the GitHub repository greedychipmunk/agent-skills (17 stars, last pushed 15d ago), licensed MIT. It adds 50 tokens to every session and 3,644 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
convex-billing
Add Stripe billing/payments to the Convex app via @convex-dev/stripe (checkout + webhook + gating).
cloudbase-wechat-integration
A guide for connecting CloudBase applications to WeChat services, including payments, official accounts, and user identity.
commerce-app-business-config
Manage custom business configuration in an Adobe Commerce app. Use when the user wants to add, modify, or remove merchant-configurable settings (config fields, admin config, store configuration) exposed through Commerce Admin. Creates typed config fields (text, password, email, url, tel, boolean, list) in…
baselinker-webhooks
Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: orderid, state), there is NO signature…
tiktok-shop-webhooks
Receive and verify TikTok Shop webhooks. Use when setting up TikTok Shop webhook handlers, debugging Authorization-header signature verification, or handling events like ORDERSTATUSCHANGE, PACKAGEUPDATE, RECIPIENTADDRESSUPDATE, PRODUCTSTATUSCHANGE, or SELLERDEAUTHORIZATION.
gplay-purchase-verification
Server-side purchase verification for in-app products and subscriptions using Google Play Developer API. Use when implementing receipt validation in your backend.