Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HCF-STUDIOS/openhermit --skill skill-creatorgit clone --depth 1 https://github.com/HCF-STUDIOS/openhermitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hcf-studios/openhermit/skill-creator)<a href="https://agentmods.dev/skills/hcf-studios/openhermit/skill-creator"><img src="https://agentmods.dev/badge/skills/hcf-studios/openhermit/skill-creator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hcf-studios/openhermit/skill-creator"><img src="https://agentmods.dev/badge/skills/hcf-studios/openhermit/skill-creator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 83 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- medium Rogue Agent · line 58 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00958 |
| Opus 5.5 | $0.00012 | $0.00383 |
| Sonnet 5.5 | $0.00006 | $0.00192 |
| Haiku 4.5 | $0.00003 | $0.00096 |
Grade A, and why
skill-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Creator
You are creating or updating an OpenHermit skill. A skill is a directory containing a SKILL.md file (with YAML frontmatter) and optional supporting files (scripts, references, templates). Skills are prompt-based instructions — they tell you what to do, not code plugins.
Skill Format
<skill-id>/
SKILL.md # Required — frontmatter + instructions
scripts/ # Optional — deterministic code the agent runs
references/ # Optional — documentation loaded on demand
templates/ # Optional — output templates, config files
SKILL.md Structure
---
name: <lowercase-hyphen-case, max 64 chars>
description: <one-line summary, max 256 chars — this appears in the system prompt index>
---
<body: detailed instructions for the agent>
Frontmatter rules:
name— required. Lowercase, hyphens only ([a-z0-9-]+), no leading/trailing/consecutive hyphens, max 64 chars.description— required. One clear sentence. This is the only thing shown in the system prompt, so it must be specific enough to trigger skill activation. Max 256 chars.
Process
1. Clarify the skill's purpose
Ask the user:
- What task does this skill handle?
- When should it activate? (What kind of user request triggers it?)
- What does success look like?
Generate 2-3 concrete usage examples to confirm understanding.
2. Plan the skill contents
For each example, identify what reusable resources are needed:
| Directory | When to use | Loaded into context? |
|---|---|---|
scripts/ |
Deterministic operations that must be exact (deploy, validate, transform) | No — executed via exec |
references/ |
Documentation the agent reads on demand (cat references/api-spec.md) |
On demand only |
templates/ |
Output files, config templates, boilerplate | No — copied/rendered via exec |
Keep SKILL.md under 500 lines. If longer, split into reference files.
3. Write the skill
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 101 lines · 31 tokens per session scan A e59cc35f80be
skill-creator is a skill published in the GitHub repository HCF-STUDIOS/openhermit (88 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 958 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
comm-agent-skill
Communication specialist for the OpenClaw multi-agent system. Use this skill when the task involves: drafting or sending emails, posting to Discord or other chat platforms, scheduling calendar events, sending notifications, or any outbound communication on behalf of the user. Always drafts before sending and requires…
data-agent-skill
Data processing and analysis specialist for the OpenClaw multi-agent system. Use this skill when the task involves: parsing CSV/JSON/Excel files, data cleaning and transformation, SQL queries, statistical analysis, generating charts or visualizations, aggregating data from multiple sources, or extracting insights from…
research-agent-skill
Information gathering and research specialist for the OpenClaw multi-agent system. Use this skill when the task involves: web search, fact-checking, comparing products or technologies, summarizing articles, gathering documentation, researching errors, or producing structured reports with sources. Also use for "what is…
system-agent-skill
System administration specialist for the OpenClaw multi-agent system. Use this skill when the task involves: package installation (apt), service management (systemctl), configuration file editing, cron job scheduling, firewall rules (ufw), disk space management, log inspection (journalctl), user/group management…
vision-agent-skill
Vision-capable agent for image analysis, screenshot interpretation, OCR, and visual tasks. Uses kimi-k2.5 for its vision capabilities (text+image input, 125k context).
code-agent-skill
Software development specialist for the OpenClaw multi-agent system. Use this skill when the task involves: writing new code, debugging existing code, code review, writing tests, git operations (commit, branch, merge), refactoring, setting up projects, or any software engineering work in Python, JavaScript/TypeScript…