Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hyfdev/moonbit-agent-skills --skill moonbit-agent-skills-maintainergit clone --depth 1 https://github.com/hyfdev/moonbit-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hyfdev/moonbit-agent-skills/moonbit-agent-skills-maintainer)<a href="https://agentmods.dev/skills/hyfdev/moonbit-agent-skills/moonbit-agent-skills-maintainer"><img src="https://agentmods.dev/badge/skills/hyfdev/moonbit-agent-skills/moonbit-agent-skills-maintainer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hyfdev/moonbit-agent-skills/moonbit-agent-skills-maintainer"><img src="https://agentmods.dev/badge/skills/hyfdev/moonbit-agent-skills/moonbit-agent-skills-maintainer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.01509 |
| Opus 5 | $0.00063 | $0.00754 |
| Sonnet 5 | $0.00025 | $0.00302 |
| Haiku 4.5 | $0.00013 | $0.00151 |
Grade A, and why
moonbit-agent-skills-maintainer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MoonBit Agent Skills maintainer
Use this skill in three modes:
- Audit: compare a MoonBit release with the repository and report gaps without changing version pins.
- Update: close every release item with evidence, update the product skills, run tests and evals, then re-pin and prepare PR data.
- Surface audit: compare the complete official language and toolchain documentation surfaces with the two product skills, close missing routes, and test high-value gaps without changing a release pin unless the compiler changed.
This workflow exists because testing only written claims cannot detect omitted knowledge, and a reference file can contain correct knowledge that agents cannot find from the main skill. Source completeness, semantic verification, and discoverability are separate checks.
Required workflow
- Read the repository's
AGENTS.md,references/release-maintenance.md,references/language-surface-maintenance.md, andreferences/toolchain-surface-maintenance.mdcompletely. When a change is expected to alter activation, retrieval, or task outcomes, also readreferences/evaluation.mdandevals/CLIENTS.mdbefore selecting tasks or a client. - Start from the single official latest state: read
https://cli.moonbitlang.com/version.json, re-pin the exact installed latest toolchain, resolve the currentmoonbitlang/moonbit-docsmaincommit, and run bothvp run snapshot-language-surfaceandvp run snapshot-toolchain-surface. If a matchingmoonbitlang/websiterelease article exists, also runvp run snapshot-release; an absent article never delays the product update. Never hand-author or filter a source inventory. - Read every generated source item. Close each exactly once in the matching
coverage.json. Release decisions use verified/documented/out-of-scope/not-actionable claims and evidence; language- and toolchain-surface items use routed/out-of-scope because those inventories prove topic handling, not semantic truth. - For every user-visible item, search both product skills and existing evidence before classifying it. Assign one product owner and make the route explicit in that skill's
Feature index, with the reference path and exact feature/diagnostic terms on one physical line. - Treat official documentation as a discovery source, not a compiler oracle. Inspect upstream warning configuration and run an isolated minimal POC with warnings enabled; the official local-type example is a known case that passes only because its package suppresses
deprecated_syntax. - Add checked documentation or fixtures for language behavior, command-manifest entries or fixtures for project behavior, and explicit
Documented, not executedtext plus a direct source for facts the environment cannot execute. - Treat deprecations as migrations: remove the old recommendation, enable the warning, add
--deny-warn, prove the old form is caught, and prove the replacement passes under the same settings. A documented-only deprecation still needs separate old-form and replacement evidence and the reason execution is unavailable. - Add a deterministic content eval for each change that materially alters agent behavior. Follow
references/evaluation.md: prove the grader with correct and wrong solutions, prefer silent-semantic risks over compiler-self-correcting tasks, and start with one paired AB/BA pass on DeepSeek Pro. Add at most one second repetition, only when the current-skill cell fails or the pair is unstable; use one Kimi fallback pair only if the current-skill cell fails again. Never run a third repetition or repeat unaffected tasks. When evaluating discoverability, use a clean task that does not expose the answer through compiler diagnostics and compare the current skill with a byte-identical purpose-built ablation of the route under test; use a historical tree only when the whole historical skill is the intended variable. Report the result in two layers: a short user-facing comparison first and the complete technical evidence second. - Treat each skill's version as its installed content identity. Whenever files inside a skill directory change, increment
metadata.skill-versionusing SemVer and setmetadata.updated-dateto the change date: patch for corrections or metadata, minor for new compatible coverage, and major for an incompatible rename or scope change. Changemetadata.verified-dateonly after rerunning the pinned verification. Keep the public README status in sync;validate-skillschecks the metadata format and README projection. - Run
vp run verify-latest-upstream, both source-verification gates, both surface-coverage gates, andvp run check-release-coverage. In update mode, close the current language and toolchain surfaces and every published release inventory before changing fixture stamps, skill pins, or README status. When the latest compiler has no website article, the exact toolchain and documentation-surface pins remain authoritative. - Run the full repository check sequence from
AGENTS.md, all relevant pinned targets, targeted model evals, and the required independent reviews.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 51 lines · 126 tokens per session scan A 12562b61c67c
moonbit-agent-skills-maintainer is a skill published in the GitHub repository hyfdev/moonbit-agent-skills (6 stars, last pushed 1mo ago), licensed MIT. It adds 126 tokens to every session and 1,509 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
jupyter-notebook
Iterative Python via live Jupyter kernel (hamelnb).
ax-cpp-gen
Use when writing C++ code with axllm for AxGen programs, forward calls, indexed multi-sampling, result pickers, streaming, tools, assertions, traces, usage, and output parsing.
ax-go-gen
Use when writing Go code with github.com/ax-llm/ax/packages/go for AxGen programs, forward calls, indexed multi-sampling, result pickers, streaming, tools, assertions, traces, usage, and output parsing.
ax-java-gen
Use when writing Java code with dev.axllm:ax for AxGen programs, forward calls, indexed multi-sampling, result pickers, streaming, tools, assertions, traces, usage, and output parsing.
ax-go-llm
Use when writing Go code with github.com/ax-llm/ax/packages/go for using the generated Ax package, factory functions, package docs, examples, and API reference.
website-md-language-docs
Use when changing Ax website language docs, language-specific snippets, examples, API symbol mappings, generated package capabilities, or adding a new website language route. Keeps the markdown-only Hugo site source-audited and generated from repo truth.