Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add j-256/agent-skills --skill dsc-endpoint-helpgit clone --depth 1 https://github.com/j-256/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/j-256/agent-skills/dsc-endpoint-help)<a href="https://agentmods.dev/skills/j-256/agent-skills/dsc-endpoint-help"><img src="https://agentmods.dev/badge/skills/j-256/agent-skills/dsc-endpoint-help/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/j-256/agent-skills/dsc-endpoint-help"><img src="https://agentmods.dev/badge/skills/j-256/agent-skills/dsc-endpoint-help.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.07313 |
| Opus 5 | $0.00033 | $0.03657 |
| Sonnet 5 | $0.00013 | $0.01463 |
| Haiku 4.5 | $0.00007 | $0.00731 |
Grade A, and why
dsc-endpoint-help scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. **Request artifact present.** A cURL command, a raw HTTP request line/block, or a `{method, url, body?}` shaped paste. Detection cues: `curl ` followed by a URL; HTTP request-line pattern (`<METHOD> <path> HTTP/`); an How it starts
The opening of the file, as written. The whole thing — 325 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DSC Endpoint Help
Answer one question about one endpoint in a Salesforce API reference on DSC – either by quoting the relevant spec field, or (when a failing request is attached) by diffing the request against the spec and naming the root cause. Every claim is backed by a public developer.salesforce.com URL the user can forward to a customer.
When to use
Lookup branch (no failing request attached):
- A direct spec-field question about a named endpoint: "what scopes does shopper-products getProducts need", "which query params does searchOrders take", "what auth scheme guards createOrder".
- A code-generation ask that references a named endpoint: "write me a node script that calls getProduct" – quote the spec the user can write the code against; don't write the code.
- A how-to ask that's really a spec-field question in disguise: "how do I paginate search results", "what limit does X accept" – quote the relevant param.
Diff branch (a failing request is attached):
- A cURL command + an error body: "why is this 403ing", "what's wrong with this request".
- A request + an
insufficient_scope/invalid_client/unauthorized_clientenvelope, optionally with a JWT to decode for the scope diff. - A content-type / body-shape failure: "diff this against the spec", "is this 415 because content-type is wrong".
Inputs from the user
The user's prompt usually contains some of:
- A reference name ("shopper-products", "orders", "scapi shopper baskets") – maybe abbreviated, maybe product-branded ("SCAPI Shopper Products" →
shopper-products). - An operation identifier ("getProducts", "createOrder", sometimes partial: "the products get endpoint", "that getCustomer call").
- A concrete spec-field question (lookup branch): what scopes, what params, what body, what response, what method/path, what auth scheme.
- A request artifact (diff branch): cURL, raw HTTP, or
{method + URL}. Required for the diff branch. - An error response (diff branch):
{status, body}. Required for the diff branch. Body can be JSON or prose. - An access token (JWT) (diff branch, optional): if provided (or embedded in the request's
Authorization: Bearerheader), the skill decodes thescpclaim for a high-confidence scope diff. - Registered client scopes (diff branch, optional): if the user has the list from their SLAS/OAuth client config, pass it instead (confidence: medium, with a disclaimer).
- Reference URL (diff branch): the developer.salesforce.com URL of the reference containing this endpoint. Usually inferrable from the request path (
/checkout/shopper-baskets/...→https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-baskets). If the path is ambiguous, ask.
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/diff-jwt-scope-decode.md 2.4 KB
- package.json 314 B
- README.md 15 KB
- scripts/classify.js 2.7 KB runs code
- scripts/decode-token.js 1.2 KB runs code
- scripts/diff.js 7.1 KB runs code
- scripts/list.js 3.5 KB runs code
- scripts/query.js 11 KB runs code
- scripts/triage.js 6.1 KB runs code
- shared/common/body-values.js 3.6 KB runs code
- shared/common/cite.js 677 B runs code
- shared/common/live-test.js 4.3 KB runs code
- shared/common/parse-request.js 6.7 KB runs code
- shared/common/pkce.js 679 B runs code
- shared/common/resolve-slug.js 6.9 KB runs code
- shared/common/scrape-refresh.js 2.4 KB runs code
- shared/common/shell-vars.js 1.3 KB runs code
- shared/common/spec-traversal.js 2.8 KB runs code
- shared/engine/auth-providers.js 3.8 KB runs code
- shared/engine/curated-facts.js 9.7 KB runs code
- shared/package-lock.json 183 B
- shared/package.json 245 B
- shared/products/commerce-b2c/auth-providers.js 7.5 KB runs code
- shared/products/commerce-b2c/auth-render.js 15 KB runs code
- shared/products/commerce-b2c/curated-facts.js 22 KB runs code
- shared/products/commerce-b2c/dedupe-scopes.js 2.7 KB runs code
- shared/products/commerce-b2c/live-baskets.js 2.0 KB runs code
- shared/products/commerce-b2c/persona.js 1013 B runs code
- shared/products/commerce-b2c/slas-flows.js 4.1 KB runs code
- shared/scrape/aliases.js 2.3 KB runs code
- shared/scrape/cache-access.js 5.2 KB runs code
- shared/scrape/cache-path.js 804 B runs code
- shared/scrape/catalog-keys.js 1.4 KB runs code
- shared/scrape/classify.js 2.2 KB runs code
- shared/scrape/extract-keys.js 2.6 KB runs code
- shared/scrape/fetch-url.js 5.4 KB runs code
- shared/scrape/load-yaml.js 311 B runs code
- shared/scrape/parse-amf.js 11 KB runs code
- shared/scrape/parse-api-catalog.js 1.5 KB runs code
- shared/scrape/parse-catalog.js 1.0 KB runs code
- shared/scrape/parse-oas.js 6.6 KB runs code
- shared/scrape/parse-swagger2.js 5.3 KB runs code
- shared/scrape/reference-versions.js 4.5 KB runs code
- shared/scrape/resolve-cache.js 4.4 KB runs code
- shared/scrape/scrape.js 19 KB runs code
- shared/scrape/write-slugs.js 1.5 KB runs code
- shared/test/fixtures/fake-scrape.js 4.0 KB runs code
- shared/test/fixtures/no-basepath-index.json 580 B
- shared/test/fixtures/ocapi-shop-customers-index.json 521 B
- shared/test/fixtures/shopper-orders-index.json 2.0 KB
- shared/test/run.sh 568 B runs code
- shared/test/test-aliases-live.js 1.5 KB runs code
- shared/test/test-aliases.js 1.4 KB runs code
- shared/test/test-body-values.js 1.8 KB runs code
- shared/test/test-cache-access.js 6.7 KB runs code
- shared/test/test-cache-path.js 1.5 KB runs code
- shared/test/test-catalog-keys-live.js 1.7 KB runs code
- shared/test/test-catalog-keys.js 2.0 KB runs code
- shared/test/test-cite.js 1.5 KB runs code
- shared/test/test-dependency-direction.js 1.2 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 325 lines · 66 tokens per session scan A 3095c4c45d4e
dsc-endpoint-help is a skill published in the GitHub repository j-256/agent-skills (2 stars, last pushed 6d ago), licensed MIT. It adds 66 tokens to every session and 7,313 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tidewave-integration
Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.
perf
Analyze Elixir/Phoenix performance — N+1 queries, assign bloat, ecto optimization, genserver bottlenecks. Use when slowness, timeouts, or high memory reported.
schema-validation
JSON/data schema validation for construction data exchange: API payloads, file imports, BIM exports. Ensure data structure compliance before processing.
interoperability-analyzer
Analyze data interoperability issues in construction projects. Identify format incompatibilities and data loss points.
deprecated-api-updater
Identify and replace deprecated API usage in source code with modern alternatives. Use when: (1) Modernizing legacy codebases, (2) Upgrading framework versions (React, Django, Spring, etc.), (3) Fixing deprecation warnings in build output, (4) Preparing for major version upgrades, (5) Ensuring code uses current best…
debug-fe-be-integration
Diagnose and fix frontend↔backend contract failures by tracing client requests, server logs, validation, auth, and responses on both sides. Use for API 4xx/5xx, mismatched payloads, validation failures, or "frontend and backend disagree". Single-layer errors → debug-error.