Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kihara777/NixKits --skill nixkits-skillsgit clone --depth 1 https://github.com/Kihara777/NixKitsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kihara777/nixkits/nixkits-skills)<a href="https://agentmods.dev/skills/kihara777/nixkits/nixkits-skills"><img src="https://agentmods.dev/badge/skills/kihara777/nixkits/nixkits-skills/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kihara777/nixkits/nixkits-skills"><img src="https://agentmods.dev/badge/skills/kihara777/nixkits/nixkits-skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.01287 |
| Opus 5 | $0.00038 | $0.00643 |
| Sonnet 5 | $0.00015 | $0.00257 |
| Haiku 4.5 | $0.00008 | $0.00129 |
Grade D, and why
nixkits-skills scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
> **dsh 例外**:DeepSeek Harness 不再是安装目标。其 NixOS 场景能力(shell 执行、工具引导、sudo 守护、NixOS 诊断)已整合进 `nixos-shell` 插件(`@kihara777/dsh-nixos-shell`),经 `nixkits.dsh.plugins.packages` 声明式挂载。 Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
for dir in ~/.opencode/skills ~/.codewhale/skills ~/.codex/skills ~/.openclaw/skills ~/.agents/skills; do Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$TMPDIR" How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NixKits 技能安装器
将 NixKits 技能安装到各编码助手的技能目录中。
支持的助手
| 助手 | 技能目录 |
|---|---|
| OpenCode | ~/.opencode/skills/ |
| CodeWhale | ~/.codewhale/skills/ |
| Codex | ~/.codex/skills/ |
| OpenClaw | ~/.openclaw/skills/ |
| 通用 | ~/.agents/skills/ |
dsh 例外:DeepSeek Harness 不再是安装目标。其 NixOS 场景能力(shell 执行、工具引导、sudo 守护、NixOS 诊断)已整合进
nixos-shell插件(@kihara777/dsh-nixos-shell),经nixkits.dsh.plugins.packages声明式挂载。
可用的技能
自动从 skills/*/SKILL.md 的 frontmatter 中提取:
for skill in skills/*/SKILL.md; do
name=$(grep '^name:' "$skill" | sed 's/name: *//')
desc=$(grep '^description:' "$skill" | sed 's/description: *//')
echo "| $name | $desc |"
done
技能列表不应硬编码;每次执行时从当前 skills/ 目录动态生成。
安装模式
模式 1:本地安装(从 NixKits 源码)
当用户已位于 NixKits 源码目录内时:
# 自动发现源码目录
NIXKITS_DIR=$(pwd)
# 或从 flake.nix 推断:
[ -z "$NIXKITS_DIR" ] && NIXKITS_DIR=$(dirname "$(readlink -f flake.nix)" 2>/dev/null)
# 将技能复制到各已存在的助手目录
for dir in ~/.opencode/skills ~/.codewhale/skills ~/.codex/skills ~/.openclaw/skills ~/.agents/skills; do
if [ -d "$dir" ]; then
cp -r "$NIXKITS_DIR/skills/"* "$dir/"
echo "Installed to $dir"
fi
done
模式 2:在线安装(从 GitHub)
当本地没有 NixKits 源码时:
# 自动发现远程仓库 URL
REPO_URL=$(git remote get-url origin 2>/dev/null || echo "")
# 克隆到临时目录
TMPDIR=$(mktemp -d)
git clone ${REPO_URL:-https://github.com/Kihara777/NixKits.git} "$TMPDIR"
# 从克隆的源码安装
for dir in ~/.opencode/skills ~/.codewhale/skills ~/.codex/skills ~/.openclaw/skills ~/.agents/skills; do
if [ -d "$dir" ]; then
cp -r "$TMPDIR/skills/"* "$dir/"
echo "Installed to $dir"
fi
done
rm -rf "$TMPDIR"
检查更新
安装前,将本地技能与源码对比:
# 本地模式:与源码对比
NIXKITS_DIR=$(pwd)
for skill_dir in "$NIXKITS_DIR/skills/"*/; do
skill_name=$(basename "$skill_dir")
for agent_dir in ~/.opencode/skills ~/.codewhale/skills ~/.codex/skills ~/.openclaw/skills ~/.agents/skills; do
if [ -d "$agent_dir/$skill_name" ]; then
if ! diff -rq "$skill_dir" "$agent_dir/$skill_name" > /dev/null 2>&1; then
echo "Update available: $skill_name in $(basename $(dirname $agent_dir))"
echo " Source: $skill_dir"
echo " Target: $agent_dir/$skill_name"
fi
fi
done
done
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 116 lines · 76 tokens per session scan D d4db39ebebec
nixkits-skills is a skill published in the GitHub repository Kihara777/NixKits (25 stars, last pushed yesterday), licensed MIT. It adds 76 tokens to every session and 1,287 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, enumerates other installed skills, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
why
Use for 'why does X work this way', 'why we picked Y', design rationale, regressions, postmortems, or data-backed thresholds. Discovers available MCPs and queries each evidence category (source control, issue tracker, long-form docs, real-time chat, infrastructure observability, error tracking, product analytics…
technical-writing
Layered technical-writing standard: Diátaxis structure, Google developer style sentences, STE instruction rules, Global English syntax. Use for /technical-writing or when writing or reviewing docs, RFCs, readmes, PR descriptions, or commit messages.
teach
Explain a body of work plainly so a person actually understands it. Runs the how and why skills and weaves what they find into one clear explanation. Use for 'teach me this', 'help me really understand X', 'explain this change or subsystem to me'.
unslop
Cut AI tells from any writing. Must always apply.
how
Use for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Can critique architecture. Use why for…
quality-code
Standards for writing or modifying handwritten source code. Use when implementing code changes or reviewing handwritten code. Do not use for browsing, explanation, diagnosis without implementation, generated code, or vendored code.