Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/initlabsai/vibekit/update-skillnpx skills add initlabsai/vibekit --skill update-skillgit clone --depth 1 https://github.com/initlabsai/vibekitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/initlabsai/vibekit/update-skill)<a href="https://agentmods.dev/skills/initlabsai/vibekit/update-skill"><img src="https://agentmods.dev/badge/skills/initlabsai/vibekit/update-skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00058 | $0.00928 |
| Opus 5 | $0.00029 | $0.00464 |
| Sonnet 5 | $0.00012 | $0.00186 |
| Haiku 4.5 | $0.00006 | $0.00093 |
Grade A, and why
update-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update a VibeKit skill
Treat skills/ as product code. Keep each skill aligned with shipped behavior,
current primary sources, and the CLI bundle that installs it into projects.
Start from current state
Before editing:
- Read the repository
AGENTS.md, the affected skill, and only its relevant references. - Inspect
git statusand preserve unrelated or user-authored changes. - Read the implementation and tests for any product behavior the skill
describes. Read
docs/CONSTITUTION.mdbefore a structural change. - Load an available
skill-creatorskill for current format and authoring guidance.
Do not document a plan, pending API, or intended release as current behavior. If implementation and guidance disagree, determine which is wrong before editing either surface.
Choose the source map
| Maintenance task | Reference |
|---|---|
| Shape descriptions, routing, progressive disclosure, references, and validation | Skill design and review |
| Refresh AVM, PuyaTs, clients, tests, wallets, ARCs, security, migration, or x402 guidance | Algorand sources |
| Refresh VibeKit CLI, tool, signing, deployment, plugin, MCP, or starter guidance | VibeKit sources |
Load only the source map needed for the change. The affected product skill remains the authoritative operational guidance; these references record where to verify it.
Editing rules
- Keep the entrypoint compact: stable purpose, important boundaries, and a task-to-reference router. Move conditional detail into focused references.
- Include guidance that changes an agent's decisions. Remove generic advice, copied manuals, stale compatibility paths, and duplicated API catalogs.
- Prefer direct canonical documentation and GitHub source examples. Verify the exact branch and path before linking.
- Keep
build-on-algorandTypeScript-only. Exclude Python and AlgoKit CLI workflows, and delegate lifecycle, LocalNet, accounts, signing, deployment, and VibeKit operations touse-vibekit. - Preserve upstream license text and a reviewed commit SHA when retained material requires attribution.
- Keep x402 and other fast-moving integrations short and link-driven.
- Do not add eval artifacts unless the user asks for them. Add tests for repository behavior or meaningful skill invariants, not prose snapshots.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 99 lines · 58 tokens per session scan A ae7abd2fd35b
update-skill is a skill published in the GitHub repository initlabsai/vibekit (27 stars, last pushed 4d ago), licensed MIT. It adds 58 tokens to every session and 928 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
algorand-interaction
Interact with Algorand blockchain via the Algorand MCP server — wallet operations, ALGO/ASA transactions, smart contracts, account info, NFD lookups, atomic groups, Tinyman swaps, Haystack Router best-price swaps, Alpha Arcade prediction markets, Pera asset verification, TEAL compilation, knowledge base. Use when user…
alpha-arcade-interaction
Trade on Alpha Arcade prediction markets on Algorand — browse markets, read orderbooks, place limit/market orders, manage positions, cancel/amend orders, split/merge shares, and claim winnings. Use when user asks about prediction markets, event betting, YES/NO shares, orderbooks, or Alpha Arcade.
algorand-x402-payment
Execute x402 payments at runtime using Algorand MCP tools. Use whenever an HTTP request returns 402 Payment Required (or a PAYMENT-REQUIRED header), the user needs to access a paid API or x402-protected resource, or the user mentions x402, micropayments, paying for an endpoint, or "payment required" — even if they…
haystack-router-interaction
Route and execute optimal token swaps on Algorand using Haystack Router via Algorand MCP tools. Use when getting best-price quotes across multiple Algorand DEXes and LST protocols, executing atomic swaps, and checking asset opt-in — all through the Algorand MCP server.
use-wallet
Integrate Algorand/AVM wallet connections using @txnlab/use-wallet v4.x. Use when building dApps that need wallet connectivity (Pera, Defly, Lute, Kibisis, Exodus, WalletConnect, etc.), transaction signing, data signing (ARC-60/SIWA), network switching, or wallet state management in vanilla JS/TS, React, Vue, SolidJS…
nfd
Work with NFDomains (NFDs), the Algorand Name Service (.algo domains), using the @txnlab/nfd-sdk TypeScript SDK. Use when building features that involve resolving .algo domain names to addresses (or reverse), displaying NFD avatars and metadata, searching for NFDs, minting new NFDs, purchasing NFDs from the…