Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/immersive-commons/ic-skills/ic-operator-adminnpx skills add Immersive-commons/ic-skills --skill ic-operator-admingit clone --depth 1 https://github.com/Immersive-commons/ic-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/immersive-commons/ic-skills/ic-operator-admin)<a href="https://agentmods.dev/skills/immersive-commons/ic-skills/ic-operator-admin"><img src="https://agentmods.dev/badge/skills/immersive-commons/ic-skills/ic-operator-admin.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00141 | $0.02573 |
| Opus 5 | $0.00071 | $0.01287 |
| Sonnet 5 | $0.00028 | $0.00515 |
| Haiku 4.5 | $0.00014 | $0.00257 |
Grade A, and why
ic-operator-admin scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -H "Authorization: Bearer $FLOOR10_AGENT_TOKEN" \ How it starts
The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You help an Immersive Commons operator's agent triage the pending-membership queue. The MCP server at https://www.immersivecommons.com/api/mcp exposes three operator verbs that are wired to the same helpers (applyTier / denyTierRequest) as the in-browser admin page at /floor10/admin/members. Behaviour is identical across transports; this skill teaches you the workflow, not the boundary.
Pre-flight (every session)
-
Token check. You need an IC agent token with
admin:tier_reviewin its scope set. Only operator-tier IC members can mint this scope —lib/capabilities.ts::SCOPES_BY_TIER.operatoris the gate, enforced server-side at mint time. Smoke probe:curl -H "Authorization: Bearer $FLOOR10_AGENT_TOKEN" \ -X POST -H "content-type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":"1","method":"tools/call","params":{"name":"ic_admin_list_pending_tier_requests","arguments":{}}}' \ https://www.immersivecommons.com/api/mcp200 + result with
pending: [](or non-empty) = good. 401 = no/bad token.token missing required scope: admin:tier_review= your token is non-operator (or your tier was demoted between mint and now — the live-tier check fires every call).REQUIRED Accept header. MCP streamable-HTTP transport gates on
Accept: application/json, text/event-stream. A bareAccept: application/json(or missing header) returns JSON-RPC-32000 "Not Acceptable"even for tools/list that doesn't actually stream. Every curl / fetch / HTTP probe against/api/mcpMUST include both content types. -
Identity check. Tools refuse if the calling operator has been demoted in Clerk since the token was minted (Layer-3 freshness gate; ~60s cached). If you see
tier check failed, the human's tier is no longer operator — escalate to a human-in-the-loop fix; do not retry.
The three verbs
1. ic_admin_list_pending_tier_requests
Read-only. Returns { pending: PendingTierRequest[], audit: TierAuditEntry[] }. Newest first. The audit tail is the last 25 approve/deny/auto-promote decisions across the queue (anyone, not just yours) — use it to understand recent context before you decide.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 156 lines · 141 tokens per session scan A cb8998156ed9
ic-operator-admin is a skill published in the GitHub repository Immersive-commons/ic-skills (0 stars, last pushed 1mo ago), licensed MIT. It adds 141 tokens to every session and 2,573 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
webmcp-e2e
WebMCP reverse connection gateway（pairing + static/remote モード）の E2E 結合確認を実行する。Manifold 起動 → デモページ → 拡張入り Chromium → ペアリング → tools/call 検証 → タブクローズ時エラー確認までを通し、スクリーンショット証跡を残す。remote モードでは自前 JWKS + JWT で identityKey ルーティングの分離も検証する。「webmcp の E2E」「reverse gateway の動作確認」「拡張の結合テスト」で使用。.
develop
Work on any Mantle project using the Core SDK contract. Use for manifest, runtime, content model, handler, adapter, validation, and MCP work after a project already exists.
install
Start a new Mantle site locally from a deterministic starter bundle, or orient and continue an existing local or Mantle landing project. Use when the user gives a Mantle repository URL and asks to try or build with it, invokes the Mantle install skill, wants a new Mantle site, or opens an existing generated site.
provision
Ship a local or Mantle landing-generated project to Cloudflare and finish production auth. Use when a Mantle project is ready for GitHub, Cloudflare deployment, self-hosted GitHub OAuth, paid Mantle hosted auth verification, production smoke testing, or operator handoff.
mantle-release
Use this skill for a Mantle version bump, npm publish, Core or Starter tag, release recovery, or an explicit Landing release caused by Core.
plugin
Discover, plan, apply, and verify Mantle marketplace plugins through the Core SDK contract. Use when the user wants to add an installable capability without hand-planning provisioning steps.