Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jerryzhang1011/waterlooworks-application-plugins --skill ww-setupgit clone --depth 1 https://github.com/jerryzhang1011/waterlooworks-application-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jerryzhang1011/waterlooworks-application-plugins/ww-setup)<a href="https://agentmods.dev/skills/jerryzhang1011/waterlooworks-application-plugins/ww-setup"><img src="https://agentmods.dev/badge/skills/jerryzhang1011/waterlooworks-application-plugins/ww-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jerryzhang1011/waterlooworks-application-plugins/ww-setup"><img src="https://agentmods.dev/badge/skills/jerryzhang1011/waterlooworks-application-plugins/ww-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00148 | $0.01810 |
| Opus 5 | $0.00074 | $0.00905 |
| Sonnet 5 | $0.00030 | $0.00362 |
| Haiku 4.5 | $0.00015 | $0.00181 |
Grade A, and why
ww-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ww-setup
Make a freshly-cloned copy of this repo able to actually run its skills. The skills
call out to external tools — python3 + reportlab to render cover letters, node
to write/validate scraped JDs, the Codex @chrome plugin to drive WaterlooWorks.
If any of those is missing, the skill fails partway through with a confusing error.
This skill finds the gaps up front and closes the ones it safely can.
The core idea
A bundled script does the detection so you don't have to eyeball every file: it walks the skills tree, infers each skill's real dependencies, checks what's installed, and classifies every missing one by how it should be installed. Your job is to run that script and then act on each class according to the policy below.
Step 1 — Detect and classify
Run the checker from the repo root. Use --json so you can act on the result
programmatically; run it without --json first if you want to show the user a readable
table.
python3 .codex/skills/ww-setup/scripts/check_skill_deps.py --root .codex/skills --json
Each missing dependency comes back with a class field that tells you exactly how to
handle it:
class |
What it is | What to do |
|---|---|---|
light |
A user-level Python package (e.g. reportlab) |
Auto-install, no need to ask. |
heavy |
A language runtime or global npm package — needs Homebrew/sudo/system change | Confirm with the user, then run. |
user |
A browser connector / external plugin (e.g. Codex's @chrome plugin) |
You can't install it from the CLI — hand it to the user with the setup hint. |
The script exits 0 when all CLI-installable deps are satisfied (browser/user deps don't
fail the check), 1 when something needs action. Installed items report class: null
and installed: true — skip those.
Step 2 — Install the safe ones automatically (light)
For every pip_packages entry with installed: false, run its install_cmd. These are
ordinary user-space package installs with no system side effects, so the user already
opted into "just do it" — don't stop to ask. The script gives you the exact command,
which already maps import names to the correct pip name (e.g. yaml → pyyaml):
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 138 lines · 148 tokens per session scan A f78fd1e048c4
ww-setup is a skill published in the GitHub repository jerryzhang1011/waterlooworks-application-plugins (1 stars, last pushed 2mo ago), licensed MIT. It adds 148 tokens to every session and 1,810 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tanstack-form-composition
Migrate a React @tanstack/react-form codebase from the prop-drilled useForm + erased-form-type pattern to the official createFormHook composition API (useAppForm / withForm / field.X). Use when a project threads a form object (often cast to an any-erased type like ReactFormExtendedApi ) through field-wrapper…
apply
Apply to a single job (URL or pasted page) with fit review, or score and apply the job links pasted into an apply campaign when no argument is given.
auto-apply
Search a job board and autonomously apply to matching jobs one at a time, until paused, exhausted, or the max-applications cap is hit.
tailor-resume
Choose the best existing resume base/variant for a job, or create a new tailored variant when nothing fits.
teaser-video
Film, cut, and deliver a short teaser/demo video of any app by driving it with Playwright and editing with ffmpeg - storyboard, authenticated capture, PII review, animated title cards, MP4 + GIF. Use for "make a teaser", "record a demo video", "product launch video", "screen recording for the README".
networking
Find a hiring manager/recruiter for a role (or company) and send a personalized message via cold email or LinkedIn, with per-campaign channels and autonomy.