Borrowing it
Nothing to install: this file belongs to justmytwospence/strava-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/justmytwospence/strava-mcp/main/.agents/skills/install-duckdb/SKILL.mdgit clone --depth 1 https://github.com/justmytwospence/strava-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/justmytwospence/strava-mcp/install-duckdb)<a href="https://agentmods.dev/skills/justmytwospence/strava-mcp/install-duckdb"><img src="https://agentmods.dev/badge/skills/justmytwospence/strava-mcp/install-duckdb/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/justmytwospence/strava-mcp/install-duckdb"><img src="https://agentmods.dev/badge/skills/justmytwospence/strava-mcp/install-duckdb.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.00674 |
| Opus 5.5 | $0.00019 | $0.00270 |
| Sonnet 5.5 | $0.00010 | $0.00135 |
| Haiku 4.5 | $0.00005 | $0.00067 |
Grade C, and why
install-duckdb scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
> - Linux: `curl -fsSL https://install.duckdb.org | sh` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> - Linux: `curl -fsSL https://install.duckdb.org | sh` This is a copy
100% identical to install-duckdb — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Arguments: $@
Each extension argument has the form name or name@repo.
name→INSTALL name;name@repo→INSTALL name FROM repo;
Step 1 — Locate DuckDB
DUCKDB=$(command -v duckdb)
If not found, tell the user:
DuckDB is not installed. Install it first with one of:
- macOS:
brew install duckdb- Linux:
curl -fsSL https://install.duckdb.org | sh- Windows:
winget install DuckDB.cliThen re-run
/duckdb-skills:install-duckdb.
Stop if DuckDB is not found.
Step 2 — Check for --update flag
If --update is present in $@, remove it from the argument list and set mode to update.
Otherwise mode is install.
Step 3 — Build and run statements
Install mode:
Parse each remaining argument:
- If it contains
@, split on@→INSTALL <name> FROM <repo>; - Otherwise →
INSTALL <name>;
Run all in a single DuckDB call:
"$DUCKDB" :memory: -c "INSTALL <ext1>; INSTALL <ext2> FROM <repo2>; ..."
Update mode:
First, check if the DuckDB CLI itself is up to date:
CURRENT=$(duckdb --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
LATEST=$(curl -fsSL https://duckdb.org/data/latest_stable_version.txt)
-
If
CURRENT==LATEST→ report DuckDB CLI is up to date. -
If
CURRENT!=LATEST→ ask the user:DuckDB CLI is outdated (installed:
CURRENT, latest:LATEST). Upgrade now?If the user agrees, detect the platform and run the appropriate upgrade command:
- macOS (
brewavailable):brew upgrade duckdb - Linux:
curl -fsSL https://install.duckdb.org | sh - Windows:
winget upgrade DuckDB.cli
- macOS (
Then update extensions:
- No extension names → update all:
UPDATE EXTENSIONS; - With extension names → update in a single call (ignore
@repo):UPDATE EXTENSIONS (<name1>, <name2>, ...);
"$DUCKDB" :memory: -c "UPDATE EXTENSIONS;"
# or
"$DUCKDB" :memory: -c "UPDATE EXTENSIONS (<ext1>, <ext2>, ...);"
Report success or failure after the call completes.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 84 lines · 48 tokens per session scan C 598c588cb55c
install-duckdb is a skill published in the GitHub repository justmytwospence/strava-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 48 tokens to every session and 674 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). It is 100% identical to install-duckdb, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
usage
Wren Engine CLI workflow guide for AI agents. Answer data questions end-to-end using the wren CLI: gather schema context, recall past queries, write SQL through the MDL semantic layer, execute, and learn from confirmed results. Use when: user asks a data question, requests a report or analysis, asks about metrics…
dlt-connector
Connect SaaS data (HubSpot, Stripe, Salesforce, GitHub, Slack, etc.) to Wren Engine for SQL analysis. Guides the user through the full flow: install dlt, pick a SaaS source, set up credentials, run the data pipeline into DuckDB, then auto-generate a Wren semantic project from the loaded data. Use this skill whenever…
generate-mdl
Generate a Wren MDL project by exploring a database with available tools (SQLAlchemy, database drivers, MCP connectors, or raw SQL). Guides agents through schema discovery, type normalization, and MDL YAML generation using the wren CLI. Use when: user wants to create or set up a new MDL, onboard a new data source, or…
wren
Wren CLI for AI agents — a semantic SQL layer over 22+ databases (Postgres, MySQL, BigQuery, Snowflake, Spark, …). The actual workflow guides live inside the wren CLI itself; this is just a discovery stub. Use whenever the user asks a data question (how many, show me, top N, compare, trend, breakdown, metric, revenue…
analytical-databases-expert
Design and query columnar analytical stores: DuckDB, ClickHouse and cloud warehouses, including file formats, partitioning, sort keys and cost control. Use when the user mentions DuckDB, ClickHouse, Parquet, columnar storage, OLAP, a data warehouse or lakehouse, analytical queries over large tables, or when the task…
duckdb
Use when analytical SQL must run in-process with no server: Parquet/CSV/JSON/Arrow queried in place, OLAP embedded in an app or notebook, a slow pandas groupby on multi-GB data, or S3/lakehouse data read without downloading. NOT a multi-user analytics server (that is clickhouse-analytics), NOT an app's transactional…