Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kensaurus/cursor-kenji --skill enhance-readmegit clone --depth 1 https://github.com/kensaurus/cursor-kenjiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kensaurus/cursor-kenji/enhance-readme)<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/enhance-readme"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/enhance-readme/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kensaurus/cursor-kenji/enhance-readme"><img src="https://agentmods.dev/badge/skills/kensaurus/cursor-kenji/enhance-readme.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 43 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 108 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.05503 |
| Opus 5 | $0.00036 | $0.02752 |
| Sonnet 5 | $0.00014 | $0.01101 |
| Haiku 4.5 | $0.00007 | $0.00550 |
Grade A, and why
enhance-readme scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 499 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Surface router:
/uiux. You are here:enhance-readme. Native iOS/Android (SwiftUI / Compose, no web layer) is out of scope — use Apple HIG / Material directly.
Enhance README
Degree of freedom: MIXED. Caption and tour selection [HIGH freedom]; capture, generator, gitignore, Camo-safe names [LOW freedom — run exactly].
Add a theme-aware hero image and a tour grid to a project's README so the repo advertises itself visually instead of being a wall of text.
How to reason
- Detect — live URL vs local, theme toggle, login
- Capture — dark and light at 1600×1000; promote to
docs/screenshots/ - Weave — name + tagline +
<picture>hero + tour under badges - Sync — badges match
package.json; first screen answers what/why/who
Worked example
Detect: live Vercel URL;
.darkclass; README is badges + install only. Capture: dashboard + three feature pages, both themes; files < 5 MB. Weave: theme-aware hero; 4-cell tour with concrete captions; skip GIF. Sync: React/Vite badges match lockfile;.playwright-mcp/gitignored.
Self-critique before reporting
- Both themes — GitHub dark and light both readable
- Camo-safe — overwritten images were renamed, not just replaced
- Artifact hygiene — keepers in
docs/screenshots/; scratch never committed - Right owner — content-only docs →
docs-writer; drift plan →plan-docs-sync
The words matter as much as the pixels
A gorgeous hero on top of a jargon wall still loses the reader. This skill owns the visual layer; for the copy, follow docs-writer's core principle — write for the reader's mental model first (answer what / why / who / how in plain language before reference detail). Don't ship a beautiful README whose first paragraph a newcomer can't parse.
The finished top of the README should read, in this order:
- Name + one plain-English tagline — what it does, no jargon
- Visual hero (
<picture>, theme-aware) — the screenshot or GIF - Why it exists / who it's for — one line each, so a wrong-fit visitor leaves early
- Shortest path to a first win — install → one command → result
- Reference depth (features, config, API) below the fold
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 499 lines · 71 tokens per session scan A 38ab82583e82
enhance-readme is a skill published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 11d ago), licensed MIT. It adds 71 tokens to every session and 5,503 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
frontend-slides
Create stunning, animation-rich HTML presentations from scratch or by converting PowerPoint files. Use when the user wants to build a presentation, convert a PPT/PPTX to web, or create slides for a talk/pitch. Helps non-designers discover their aesthetic through visual exploration rather than abstract choices.
goose-graphics
Portable visual skill pack for the Agent Skills ecosystem (Claude Code, Claude Desktop, Claude Cowork, Claude Design, Goose, Cursor, Codex). Discovers community-published styles + formats via the gooseworks CLI, runs an extract-style workflow on reference images, and exports rendered PNGs via Playwright.
brand-intel-branddev
Brand intelligence - logos, colors, fonts, styleguides, and company data from any domain.
create-workflow-diagram
Create FigJam/Miro-style workflow diagrams as high-quality PNG images from plain-text workflow descriptions. Renders beautiful HTML diagrams with connected nodes, arrows, and labels, then screenshots them for sharing.
goose-graphics-create-style
End-to-end skill that turns a single reference image into a published Gooseworks style — analyzes the image, drafts the slim style spec, renders a hero example plus 2-3 additional formats via Playwright, writes the gooseworks-style.json manifest, and publishes via npx gooseworks styles publish so other agents can…
create-chatgpt-mockup
Render pixel-accurate ChatGPT mobile (iOS) screen mockups in light mode from a thread JSON. Supports user text bubbles, user image attachments, assistant markdown prose, citation chips, the OpenAI spiral logo, the Apps-SDK GPT chip in the composer, and three header styles (model-tag, plain title, "Get Plus"). Fixed…