Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/harebeats/cannonball/kit-tiponpx skills add harebeats/cannonball --skill kit-tipogit clone --depth 1 https://github.com/harebeats/cannonballWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/harebeats/cannonball/kit-tipo)<a href="https://agentmods.dev/skills/harebeats/cannonball/kit-tipo"><img src="https://agentmods.dev/badge/skills/harebeats/cannonball/kit-tipo.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00199 | $0.02830 |
| Opus 5 | $0.00100 | $0.01415 |
| Sonnet 5 | $0.00040 | $0.00566 |
| Haiku 4.5 | $0.00020 | $0.00283 |
Grade A, and why
kit-tipo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 263 lines — stays where its author put it; the contents beside it link to each section on GitHub.
kit-tipo — decidir o tipo, e poder entregá-lo
Antes de qualquer comando: resolva o SKILL_DIR
Todo comando abaixo roda um script que viaja junto desta skill, em
SKILL_DIR/scripts/. Defina SKILL_DIR como o caminho absoluto da pasta que
contém ESTE SKILL.md que você acabou de ler — o seu harness informou esse caminho
no resultado da leitura. Funciona em qualquer hospedeiro, sem depender de variável
de ambiente de nenhum agente específico:
~/.claude/plugins/cache/cannonball/cannonball/<v>/skills/<nome>/SKILL.md
~/.codex/skills/<nome>/SKILL.md
~/.gemini/skills/<nome>/SKILL.md
~/.agents/skills/<nome>/SKILL.md
Em todos, SKILL_DIR é a pasta do SKILL.md, e SKILL_DIR/scripts/ está ao lado.
A kit-cor existe porque o acervo tem cor demais e decisão de menos. Aqui o
problema é o inverso, e é mais grave: o acervo nomeia 389 fontes
diferentes, 341 delas usadas uma única vez (87%).
python "${SKILL_DIR}/scripts/tipo.py" --vies
Isso não é variedade. É a lista de compras de outras marcas. Os design
systems foram extraídos de sites reais, e site de marca paga por tipo: Aeonik,
Roobert, GT Standard, Suisse Int'l, Söhne, PP Neue Montreal, Lausanne
— todas comerciais, com licença web cobrada por pageview ou por domínio.
Dois padrões que definem o trabalho desta skill, e que aparecem em qualquer acervo montado a partir de site real:
- Design system nomeia a fonte e não diz onde carregá-la. Ele diz "use ES Allianz" e para. Nenhum traz licença, origem ou substituto — isso é trabalho seu.
- Prompt de página puxa de
db.onlinewebfonts.come de outros sites que redistribuem fonte comercial sem licença. Entregar isso ao cliente é entregar o problema junto.
Quantas peças do seu acervo estão em cada caso:
python "${SKILL_DIR}/scripts/tipo.py" --vies
python "${SKILL_DIR}/scripts/tipo.py" --classificar
Cor é de graça. Tipo não é. Essa é a diferença que organiza tudo aqui.
0. Escala não é decoração — é tempo
What ships with it
52 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/fundamentos-visuais.md 19 KB
- references/getlayers.md 8.5 KB
- references/higgsfield.md 4.6 KB
- references/motionsites-genjutsu-designdna.md 7.0 KB
- references/stack-animacao.md 7.1 KB
- references/stack-webgl-react.md 13 KB
- scripts/armadilhas.py 4.8 KB runs code
- scripts/assets.py 4.8 KB runs code
- scripts/buscar.py 9.4 KB runs code
- scripts/caminhos.py 6.4 KB runs code
- scripts/capturar.py 19 KB runs code
- scripts/cor.py 11 KB runs code
- scripts/curar.py 12 KB runs code
- scripts/fontes_licenca.json 19 KB
- scripts/indexar.py 10 KB runs code
- scripts/ingerir_design.py 6.7 KB runs code
- scripts/ingerir_mcp.py 7.6 KB runs code
- scripts/ingerir_projeto.py 10 KB runs code
- scripts/ingerir_registro.py 5.1 KB runs code
- scripts/ingerir.py 5.4 KB runs code
- scripts/lote.py 5.5 KB runs code
- scripts/normalizar.py 10.0 KB runs code
- scripts/painel.py 20 KB runs code
- scripts/perfil.py 10 KB runs code
- scripts/publicar.py 12 KB runs code
- scripts/receita.py 4.8 KB runs code
- scripts/relocalizar.py 6.0 KB runs code
- scripts/sinonimos.json 7.6 KB
- scripts/tags_funcao.py 5.8 KB runs code
- scripts/test_sinonimos.py 1.8 KB runs code
- scripts/tipo.py 22 KB runs code
- scripts/vincular.py 5.0 KB runs code
- seed/acervo/index.json 18 KB
- seed/acervo/ui/kit-agendamento/armadilhas.json 4.1 KB
- seed/acervo/ui/kit-agendamento/codigo/agendamento.css 8.0 KB
- seed/acervo/ui/kit-agendamento/codigo/Agendamento.tsx 13 KB
- seed/acervo/ui/kit-agendamento/codigo/regras.ts 4.8 KB runs code
- seed/acervo/ui/kit-agendamento/codigo/useAgendamento.ts 4.0 KB runs code
- seed/acervo/ui/kit-agendamento/item.json 1.7 KB
- seed/acervo/ui/kit-agendamento/README.md 6.2 KB
- seed/acervo/ui/kit-calendario/armadilhas.json 798 B
- seed/acervo/ui/kit-calendario/codigo/calendario.css 5.4 KB
- seed/acervo/ui/kit-calendario/codigo/Calendario.tsx 7.7 KB
- seed/acervo/ui/kit-calendario/codigo/useCalendario.ts 4.1 KB runs code
- seed/acervo/ui/kit-calendario/item.json 1.4 KB
- seed/acervo/ui/kit-calendario/README.md 3.9 KB
- seed/acervo/ui/kit-mapa/armadilhas.json 747 B
- seed/acervo/ui/kit-mapa/codigo/mapa.css 5.3 KB
- seed/acervo/ui/kit-mapa/codigo/Mapa.tsx 4.7 KB
- seed/acervo/ui/kit-mapa/item.json 1.6 KB
- seed/acervo/ui/kit-mapa/README.md 4.3 KB
- seed/LEIA.md 905 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 0f0f709952b3
- 5d ago First seen · 262 lines · 199 tokens per session scan A 215ba3d01966
kit-tipo is a skill published in the GitHub repository harebeats/cannonball (9 stars, last pushed yesterday), licensed MIT. It adds 199 tokens to every session and 2,830 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
client-outreach
Generate cold-outreach openers, value-led follow-up sequences, niche-authority positioning, and a tool-import CSV with CAN-SPAM/GDPR/CASL compliance-checklist fields for landing the first clients in a service business. Uses copywriting for sharper lines when available; otherwise drafts them inline. Trigger when the…
security-and-compliance
Use when user mentions "security review", "compliance", "SOC 2", "GDPR", "PII", "threat model", when the system handles sensitive data, when preparing for an audit or certification, when assessing risk before launch, or when a STRIDE threat model is needed for a new component.
fast-typescript-check
Keep www-sacred's TypeScript fast to type-check and fast to run. Use when touching the ASCII/canvas animation components (the only real per-frame code here), tightening type-check wall-clock, or auditing a change for runtime or compiler regressions. Scoped to this repo — a React 19 / Next.js 16 component library plus…
port-sacred-terminal-ui-to-typescript-cli
Take a React Window.tsx (or any sacred component) and produce a terminal CLI screen written in TypeScript that uses Simulacrum — the sacred CLI framework in scripts/cli/lib/.
designlang-tokens
Use when styling UI for cal.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.
port-sacred-terminal-ui-to-react-using-same-conventions
Take a CLI screen written for Simulacrum — the sacred CLI framework (scripts/cli/templates/.ts or scripts/python/templates/.py) — and produce a React component that lives inside components/examples/ (or components/) using only sacred's existing primitives — Window, Card, SimpleTable, ActionButton, RowSpaceBetween…