Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add iker-gonzalez/antwork-skills --skill antwork-mediagit clone --depth 1 https://github.com/iker-gonzalez/antwork-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iker-gonzalez/antwork-skills/antwork-media)<a href="https://agentmods.dev/skills/iker-gonzalez/antwork-skills/antwork-media"><img src="https://agentmods.dev/badge/skills/iker-gonzalez/antwork-skills/antwork-media/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iker-gonzalez/antwork-skills/antwork-media"><img src="https://agentmods.dev/badge/skills/iker-gonzalez/antwork-skills/antwork-media.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.00777 |
| Opus 5 | $0.00044 | $0.00388 |
| Sonnet 5 | $0.00017 | $0.00155 |
| Haiku 4.5 | $0.00009 | $0.00078 |
Grade B, and why
antwork-media scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
2. The user (or you, via a shell) PUTs the file straight to that URL, e.g. `curl -X PUT -H "Content-Type: image/png" --data-binary @photo.png "<signedUrl>"`. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. The user (or you, via a shell) PUTs the file straight to that URL, e.g. `curl -X PUT -H "Content-Type: image/png" --data-binary @photo.png "<signedUrl>"`. How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Media in Antwork
Attaching media depends on where you're running. Every post tool response carries a hostSupportsUi flag — read it and pick the right path. Get this wrong and you'll either call a tool that doesn't exist on this host, or make the user do manual work the UI would have done for them.
Path A — UI hosts (Claude.ai, Claude Desktop)
When hostSupportsUi is true, the post card renders its own Add media picker. The user drops a file straight onto the card and it attaches automatically.
- Do NOT call
upload_media_inlinefrom chat — it's an iframe-internal tool wired to the picker over a postMessage bridge (from_ui_bridge=True). Calling it from a normal tool turn fails. - Your job here is just to tell the user to use the Add media button on the card.
Path B — CLI hosts (Claude Code, Cursor, shells)
When hostSupportsUi is false there's no picker. Use the signed-upload flow for a local file:
request_upload_url(mime_type, byte_size)→ returns a short-lived signed PUT URL, agcsPath, andexpiresInSeconds.- The user (or you, via a shell) PUTs the file straight to that URL, e.g.
curl -X PUT -H "Content-Type: image/png" --data-binary @photo.png "<signedUrl>". register_uploaded_media(gcs_path, mime_type, byte_size, attach_to_post_id)verifies the object landed in GCS, registers it in the workspace library, and — withattach_to_post_id— attaches it to the post in the same call.
The signed URL expires, so finalize promptly after the PUT.
Public images (incl. AI-generated)
If the media is already at a public HTTPS URL — an AI image you just generated, a hosted asset — skip the signed flow: upload_media(image_url, mime_type) downloads it server-side and stores it in the library. Then attach_media it (below), or pass it through register_uploaded_media's attach hook if applicable.
Attaching to an existing post
attach_media(post_id, media_urls) attaches a list of media URLs to a post. It replaces the post's existing media rather than appending — pass the full set you want, not just the new one.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 46 lines · 87 tokens per session scan B 4266eb7934a4
antwork-media is a skill published in the GitHub repository iker-gonzalez/antwork-skills (0 stars, last pushed 2mo ago), licensed MIT. It adds 87 tokens to every session and 777 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
markdown-to-pdf
Convert a markdown file to PDF using mistune + reportlab. Use when the user wants to convert a .md file to PDF, or when another skill needs to produce a PDF from markdown output.
deck-to-html
Convert a PDF or PowerPoint deck into a single self-contained interactive HTML presentation — native animated SVG charts, sequenced entrance animations, live-embedded demos, keyboard navigation, and a PDF export path. Use whenever someone wants a deck turned into HTML, an "interactive"/"animated"/"web" version of…
pdf-extractor
Extract text, tables, and images from PDFs. Use when: extracting data from reports; converting PDF tables to CSV; pulling images from presentations; processing research papers; batch converting PDFs to text.
media-doc-processing
Canonical media and document processing covering Fal AI media, video editing, videodb, Manim video, Remotion video creation, nutrient document processing, and visa document translation.
report-generator
Generate PDF/HTML reports from templates and data. Use when: creating client reports; generating weekly summaries; producing marketing performance reports; automating recurring reports.
brochure-generator
Generates premium, multi-page, mobile-optimized (1:1 aspect ratio) PDF marketing brochures for exclusive retreats, workshops, luxury events, or any high-end product/service offering. Use this skill whenever a user asks to create a brochure, marketing PDF, event flyer, WhatsApp marketing material, social media…