Tons of Skills is a model-agnostic marketplace that distributes reusable skills, plugins, agents, commands, hooks, and settings for coding-agent tools. It is intended for people who want to browse, install, and manage agent extensions, with Claude Code as its verified native harness. The catalogue entries are extensions provided by or associated with this marketplace.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jeremylongshore/tons-of-skills-marketplace --skill stickygit clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jeremylongshore/tons-of-skills-marketplace/sticky)<a href="https://agentmods.dev/skills/jeremylongshore/tons-of-skills-marketplace/sticky"><img src="https://agentmods.dev/badge/skills/jeremylongshore/tons-of-skills-marketplace/sticky/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jeremylongshore/tons-of-skills-marketplace/sticky"><img src="https://agentmods.dev/badge/skills/jeremylongshore/tons-of-skills-marketplace/sticky.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 121 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00097 | $0.02604 |
| Opus 5 | $0.00048 | $0.01302 |
| Sonnet 5 | $0.00019 | $0.00521 |
| Haiku 4.5 | $0.00010 | $0.00260 |
Grade A, and why
sticky scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sticky
Set per-project auto-routing mode. Three states:
| State | Default? | Behavior |
|---|---|---|
auto |
yes (when .sticky absent) |
Intent-detection routing — messages containing chain-starter verbs (audit, debug, fix, brainstorm, scope, deploy, review, …) auto-route. Pure conversation passes through. |
on |
— | Full sticky — every task-shaped message routes, even without explicit intent verbs |
off |
— | All auto-routing disabled — only explicit /hyperflow:* slash commands trigger chains |
Intent-detection is the floor — the user gets it without any opt-in (the orchestrator scans every user message for chain-starter verbs and routes when matched). Sticky on raises the ceiling; sticky off lowers the floor.
Full doctrine: DOCTRINE.md Layer 1 auto-routing clause (intent verb taxonomy + routing contract + bypass patterns).
Subcommands
| Subcommand | Description |
|---|---|
on |
Set state: on — full sticky routing on every task-shaped message |
auto |
Set state: auto — intent-verb routing only (the default) |
off |
Set state: off — disable ALL auto-routing including intent detection |
status |
Show current state (on / auto / off / when toggled) |
Default subcommand when none provided: status.
State persistence
Sticky state is stored at .hyperflow/.sticky (project-scoped, gitignored). File format:
state: on
since: 2026-05-17T14:30:00Z
trigger: user-mention # or: explicit-toggle | session-default
The session-start hook reads this file and prints a one-line advisory when sticky is on (Sticky mode: ON since 2026-05-17 14:30 — task-shaped messages auto-route through hyperflow). Sticky persists across sessions until explicitly toggled off.
Subcommand Details
on
Write .hyperflow/.sticky with state: on + ISO-8601 timestamp + trigger: explicit-toggle. Print:
Sticky mode: ON (full routing)
Every task-shaped message now routes through hyperflow, even without intent verbs.
Disable with /hyperflow:sticky off · or relax to verb-only routing with /hyperflow:sticky auto.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 239 lines · 97 tokens per session scan A cea734ebd0f2
sticky is a skill published in the GitHub repository jeremylongshore/tons-of-skills-marketplace (2,717 stars, last pushed today), licensed MIT. It adds 97 tokens to every session and 2,604 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gws-gmail
Gmail: Send, read, and manage email.
recipe-block-focus-time
Create recurring focus time blocks on Google Calendar to protect deep work hours.
recipe-create-vacation-responder
Enable a Gmail out-of-office auto-reply with a custom message and date range.
recipe-save-email-attachments
Find Gmail messages with attachments and save them to a Google Drive folder.
happiness-skill
A Chinese-language guide to happiness based on reducing unmet wants, focusing on the present, and treating happiness as a trainable skill.
post-build-flow
Handles workflow verification and setup after build-workflow succeeds, or when the message contains workflow-verification-follow-up or workflow-setup-required. Load after direct builds, when verificationReadiness requires action, or on orchestrator verify/setup follow-up turns.