Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joao-aires/agent-skills-public --skill tooling-conventionsgit clone --depth 1 https://github.com/joao-aires/agent-skills-publicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joao-aires/agent-skills-public/tooling-conventions)<a href="https://agentmods.dev/skills/joao-aires/agent-skills-public/tooling-conventions"><img src="https://agentmods.dev/badge/skills/joao-aires/agent-skills-public/tooling-conventions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joao-aires/agent-skills-public/tooling-conventions"><img src="https://agentmods.dev/badge/skills/joao-aires/agent-skills-public/tooling-conventions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00627 |
| Opus 5.5 | $0.00018 | $0.00251 |
| Sonnet 5.5 | $0.00009 | $0.00125 |
| Haiku 4.5 | $0.00005 | $0.00063 |
Grade A, and why
tooling-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Implement the selected development tools
Read the accepted toolchain, project commands and versions before changing configuration. This skill supplies implementation choices for matching tools; it does not select an application stack, install services merely to follow a reference or authorize publication. Preserve an existing suitable setup. Use available project, delivery, journey or operations methods for the intended outcome; retain meaningful checks and recovery evidence when those optional skills are absent.
Choose the relevant reference
| Selected work | Reference |
|---|---|
| Code/configuration/secret checks and local hook setup | Quality tools |
| Dockerfiles, image inputs and runtime startup | Container builds |
| Compose profiles, isolated local services and diagnostics | Local environment |
| GitHub Actions adapters, trust, inputs and concurrency | Workflow implementation; use installed github-actions-hardening for deeper matching review |
| Chosen registry and release artifact checks | Artifact defaults |
| Selected Collector/backend routing and AI evaluation service | Telemetry backends |
| Browser/Electron drivers and component workbenches | Journey drivers; use installed playwright-cli when applicable |
| Scoped fault fixtures or a selected network proxy | Failure tools |
Read only the relevant reference. Language-specific checks and packaging follow the accepted stack's conventions; native drivers follow native-platform implementation and driver expertise when available. Use performance-testing for an accepted k6 implementation, rather than imposing k6 on an existing suite.
Verify the actual integration
Connect the selected tool to the project's existing commands and execution environment. Establish its inputs, the configuration it actually reads, the outputs another step consumes, and the status that should stop the workflow. Check differences between local, container and runner execution, especially working directories, network addresses, environment variables and owned data.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/artifact-defaults.md 3.1 KB
- references/container-builds.md 1.1 KB
- references/failure-tools.md 1.0 KB
- references/journey-drivers.md 1.4 KB
- references/local-environment.md 2.1 KB
- references/quality-checks.md 1.9 KB
- references/telemetry-backends.md 3.4 KB
- references/workflow-implementation.md 5.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +6 lines 2944a83a1c1a
- 2d ago First seen · 36 lines · 45 tokens per session scan A 3f50e932ce1f
tooling-conventions is a skill published in the GitHub repository joao-aires/agent-skills-public (2 stars, last pushed yesterday), licensed MIT. It adds 45 tokens to every session and 627 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when setting up deployment infrastructure or planning releases.
performing-container-security-scanning-with-trivy
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
devops-deployment
Use when setting up CI/CD pipelines, containerizing applications, deploying to Kubernetes, or writing infrastructure as code. DevOps & Deployment covers GitHub Actions, Docker, Helm, and Terraform patterns.
CI/CD Pipeline Advanced
Expert-level CI/CD pipeline skill for test automation. Covers GitHub Actions, Jenkins, GitLab CI, Azure DevOps, parallel execution, matrix strategies, caching, artifact management, and deployment gates.
test-environments
Design environment strategy for testing across dev, CI, preview, staging, and production — Docker Compose test infrastructure, multi-stage Dockerfiles, seed-data lifecycle, per-PR preview environments, production parity, and external-dependency stubbing at the HTTP boundary. Use when: "set up test environment,"…
temps-platform-setup
Provision, verify, and connect a self-hosted Temps platform instance on an explicitly authorized machine. Use when the user wants an agent to install Temps with the official deploy script, configure a local CLI context, start browser device authorization, present the approval URL, wait for approval, or perform initial…