Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/inkbox-ai/inkbox/inkbox-clinpx skills add inkbox-ai/inkbox --skill inkbox-cligit clone --depth 1 https://github.com/inkbox-ai/inkboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/inkbox-ai/inkbox/inkbox-cli)<a href="https://agentmods.dev/skills/inkbox-ai/inkbox/inkbox-cli"><img src="https://agentmods.dev/badge/skills/inkbox-ai/inkbox/inkbox-cli.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00081 | $0.11192 |
| Opus 5 | $0.00041 | $0.05596 |
| Sonnet 5 | $0.00016 | $0.02238 |
| Haiku 4.5 | $0.00008 | $0.01119 |
Grade A, and why
inkbox-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 827 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Inkbox CLI
Command-line interface for the Inkbox API — identities, email, phone, text/SMS, encrypted vault, mailboxes, phone numbers, signing keys, and webhook utilities.
Auth & Runtime
Set credentials via env vars or global flags:
export INKBOX_API_KEY="ApiKey_..."
export INKBOX_VAULT_KEY="my-vault-key" # only needed for vault decrypt/create flows
Global options:
--api-key <key> Inkbox API key (or set INKBOX_API_KEY)
--vault-key <key> Vault key for decrypt operations (or set INKBOX_VAULT_KEY)
--base-url <url> Override API base URL
--json Output as JSON instead of formatted tables
If INKBOX_API_KEY is missing and --api-key is not passed, the CLI exits with an error.
Prefer --json when the result will be parsed or fed into another tool. Use the default table/record output when the user wants a quick human-readable summary.
With --json, success stays on stdout and API failures write one structured error
object to stderr, retaining error.detail and error.retryAfterSeconds.
Install & Local Repo Usage
Published package:
npm install -g @inkbox/cli
Or run without a global install:
npx @inkbox/cli <command>
Requires Node.js >= 22.
Inside this repository, prefer running the local source instead of assuming a global install:
npm --prefix cli run dev -- <command>
Examples:
npm --prefix cli run dev -- --json identity list
npm --prefix cli run dev -- email list -i support-bot --limit 10
High-Risk Operations
These commands can send real traffic or mutate real resources. Confirm with the user before running them:
signup createa2a invites create,a2a invites revoke, anda2a invites acceptemail sendemail drafts sendtext sendphone callidentity deleteemail deleteemail delete-threademail drafts deletevault deleteidentity update --mail-filter-mode ... / --phone-filter-mode ...(admin-only; flips allow/block semantics for that identity's channel)mailbox update --filter-mode ...(DEPRECATED channel path; admin-only)number releasenumber update --filter-mode ...(DEPRECATED channel path; admin-only)phone incoming-action <action>/number update --incoming-call-action ...(changes what answers that identity's inbound calls —hosted_agentmakes the platform voice agent pick up)identity signing-key rotate <handle>(rotates that identity's webhook signing key)signing-key create(DEPRECATED org-level path)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +6 lines 9de85fd7e7be
- 4d ago First seen · 821 lines · 81 tokens per session scan A d83958099284
inkbox-cli is a skill published in the GitHub repository inkbox-ai/inkbox (67 stars, last pushed today), licensed MIT. It adds 81 tokens to every session and 11,192 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
testing-rate-limiting
Apply deterministic SlowAPI rate-limiter isolation for FastAPI transport tests, especially to avoid flaky HTTP 429 responses.
Skill Creator
Create new Cursor Skills following the standard directory structure.
Code Quality Review
Conduct a comprehensive code quality review focused on clean code, architecture, and project standards.
Security Review
Conduct a thorough security audit focused on OWASP Top 10, secrets detection, and input validation.
publish-run402-core
Publish Run402 Core npm packages from kychee-com/run402-core via GitHub Actions OIDC Trusted Publisher. Use when asked to publish, release, bump, dry-run, or verify @run402/functions, @run402/release, or @run402/runtime-kernel from the Core repo.
zero-api-key-web-search
OpenClaw skill for source-backed web search, page reading, and evidence-aware claim checking. No API keys required by default; optional providers can be enabled for stronger coverage. v23: multi-engine SERP (7 engines), Web Unlocker for blocked pages, auto-fallback on 403/429.