Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Green-PT/honey-for-devs --skill honey-pxgit clone --depth 1 https://github.com/Green-PT/honey-for-devsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/green-pt/honey-for-devs/honey-px)<a href="https://agentmods.dev/skills/green-pt/honey-for-devs/honey-px"><img src="https://agentmods.dev/badge/skills/green-pt/honey-for-devs/honey-px/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/green-pt/honey-for-devs/honey-px"><img src="https://agentmods.dev/badge/skills/green-pt/honey-for-devs/honey-px.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 46 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.00690 |
| Opus 5 | $0.00009 | $0.00345 |
| Sonnet 5 | $0.00004 | $0.00138 |
| Haiku 4.5 | $0.00002 | $0.00069 |
Grade A, and why
honey-px scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Honey PX
An image's token cost is fixed by its pixel area, not its character count.
Dense text packs ~3 chars per image-token vs ~1 as text, so a 90k-char file
read as PNG pages costs a fraction of the text read. pxpipe export
(teamchong/pxpipe) does the rendering; the agent Reads the pages.
Lossy by design — misreads of exact strings are silent confabulations,
not errors. The export writes a factsheet.txt carrying the verbatim
precision tokens (paths, SHAs, ids, numbers) as text alongside the images;
always read it too.
When to use
- Bulk is read-only reference: skimming a big vendored file, a large diff for review context, docs, generated code — content you reason over, not byte-copy.
- Dense (code, JSON, logs) and big — worth it above ~6k chars; the
export prints
% saved, skip if it's low. Sparse prose loses money. - The reader is Fable-class. Opus misreads ~7% of renders; other models degrade — read as text there.
Don't use
- Files you will Edit —
old_stringmust be byte-exact; imaged reads aren't. Read the real file (withoffset/limit) before any edit. - Secrets, hashes, ids, numeric values you'll act on — treat anything
exact recalled from an image as unverified; re-
Grepthe source first. - Anything the user asked to see verbatim, or that gets written back.
- Small or sparse content — the fixed pixel cost loses.
How
npx pxpipe-proxy export --json --out <scratchpad> <file-or-dir> # or --git / --diff <ref> / --stdin
Output dir pxpipe-export-<hash>/ contains page-*.png, factsheet.txt,
manifest.json (token report). Then:
Readeverypage-*.pngandfactsheet.txt. If instead you pass the renders to a model over the raw API (subagent prompt, panel), include the export'sprompt.txtbanner — naked dense renders can tripstop_reason: refusalon Fable-class models; the banner prevents it.- Treat the manifest's
percentSavedas the go/no-go — if it printed low, read the text instead. - Before acting on any exact string seen only in an image, verify it against
the source with
Grep.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 64 lines · 18 tokens per session scan A e583557e806d
honey-px is a skill published in the GitHub repository Green-PT/honey-for-devs (295 stars, last pushed 4d ago), licensed MIT. It adds 18 tokens to every session and 690 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pdf-conversion
Convert PDF documents to well-structured Markdown files. Use when user asks to convert PDFs, extract text from PDFs, or transform PDF documents to markdown format.
markitdown
Convert files, URLs, and documents to Markdown using the markitdown MCP server. Activate when the user asks to convert, extract, or read content from PDFs, Word docs, PowerPoints, spreadsheets, images, audio files, or any URL.
t-800-knowledge-base
A map of the T-800 plugin's knowledge base, which is the stored documentation used by its maintainers.
pn-financial-model-audit
Audit a financial model (spreadsheet, structured table, or agent-produced model) for hardcoded values, broken formula logic, balance-sheet balance, circular references, and missing cross-checks. Use after any DCF, LBO, comps, or 3-statement model is built before it is used in a deliverable.
pn-create-mcp-architecture
Create MCP.md documenting MCP servers in use, purpose, and integration points. Use when project uses multiple MCPs or needs MCP documentation.
tracker-builder
This skill should be used when the user asks to "build me a metrics tracker," "wire up a daily log to the summary sheet," "create a performance tracker spreadsheet," or needs an actual spreadsheet built that replicates a Daily Log / summary-sheet pattern with formulas wired between tabs.