Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kong/ai-marketplace --skill kong-skill-authoringgit clone --depth 1 https://github.com/Kong/ai-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kong/ai-marketplace/kong-skill-authoring)<a href="https://agentmods.dev/skills/kong/ai-marketplace/kong-skill-authoring"><img src="https://agentmods.dev/badge/skills/kong/ai-marketplace/kong-skill-authoring/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kong/ai-marketplace/kong-skill-authoring"><img src="https://agentmods.dev/badge/skills/kong/ai-marketplace/kong-skill-authoring.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01770 |
| Opus 5 | $0.00026 | $0.00885 |
| Sonnet 5 | $0.00010 | $0.00354 |
| Haiku 4.5 | $0.00005 | $0.00177 |
Grade A, and why
kong-skill-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kong skill authoring
Goal
Help contributors create or revise high-signal skills for this repository without creating overlap, generic filler, root bloat, or tool-boundary confusion.
Treat AGENTS.md as the canonical authoring policy. Use this skill as the
decision layer for what the skill should own, how it should be structured, and
what should stay out of it.
Tool Selection
- Use the host environment's built-in generic skill-authoring helper first when it materially improves structure, then apply this repo's rules as the final authority.
- Use this skill for authoring decisions and review workflow, not for the Konnect or Gateway task that the target skill will later handle.
- When the user is asking for product execution, diagnosis, or declarative implementation rather than skill authoring, hand off to the relevant domain, router, or tool skill instead of keeping the work here.
References To Load
- Load
AGENTS.mdfirst for authoring policy, section conventions, layered skill design, and plugin-aware repo boundaries. - Load
docs/skills.mdand inspectplugins/*/skills/*/SKILL.mdwhen checking for overlap, adjacent trigger surfaces, or handoff targets.
Workflow
- State the target skill's job in one sentence.
- If the request is really about doing Konnect or Gateway work rather than authoring the skill, stop and hand off.
- Check overlap before drafting.
- Inspect
docs/skills.mdand the existingplugins/<plugin>/skills/trees. - Extend an existing skill when the trigger class, ownership boundary, and operating procedure are substantially the same.
- Create a new skill only when the workflow, owner, or trigger surface is materially different.
- Inspect
- Classify the skill boundary.
- Use a domain skill when the hard part is Kong-specific diagnosis, inspection order, or operator workflow.
- Use a tool skill when the hard part is
decK,kongctl, Terraform, import/adopt behavior, or file-shape ownership. - Use a router skill only when the main problem is broad classification across existing specialist skills.
- If both domain and tool concerns appear, keep diagnosis in the domain skill and hand off implementation to the tool skill.
- Define the trigger surface before writing body text.
- Write down what a user would actually ask.
- Name the nearby requests that should not activate the skill.
- Keep the
descriptionactivation-grade: front-loaded, explicit, and usually under roughly 260 characters. - Tighten the boundary instead of adding long example lists.
- Keep
SKILL.mdas the decision layer.- Root content should cover ownership, workflow or inspection order, defaults, validation, and handoffs.
- Do not turn the root into a command catalog, product guide, schema dump,
or copy of repo policy that already lives in
AGENTS.md. - Prefer subtraction before rewriting. Delete detail that does not change agent behavior.
- Place detail in the cheapest useful layer.
- Keep branch-specific depth in
references/with an explicit load condition. - Make each reference file support one branch, failure domain, or execution mode. Split files that carry multiple unrelated jobs.
- Add a
scripts/helper only when deterministic validation or transformation is materially safer than prompt text. - Do not create companion files just to relocate generic filler.
- Keep branch-specific depth in
- Run the review tests before you finalize structure.
- Overfitting test: remove assumptions about one repo layout, starter bundle, exact command path, exact auth check, current UI behavior, or one canonical naming scheme unless that specificity is safety-critical.
- Minutiae test: trim long field lists, dense flag catalogs, or examples that the model would copy more readily than reason from.
- Progressive-disclosure test: move detail down a layer when metadata, root, references, or scripts can hold it more cheaply without harming behavior.
- If the root still reads like a condensed runbook or partial manual, cut or relocate content before polishing wording.
- Apply the repo's section conventions.
- Domain skills should use
Goal,Tool Selection,References To Load,WorkfloworInspection Order, an explicit gotchas section,Validation Checklist, andHandoffs. - Tool skills should use
Goal,Tool Positioning,References To Load,Validation Contract,Operating Rules,Workflow,Validation Checklist, andHandoffs. - Router skills should use
Goal,Shared Operating Defaults,Classification Order,Routing Rules,Validation Checklist, andOutput Style. - Do not introduce cosmetic heading drift for equivalent concepts.
- Domain skills should use
- Preserve Kong-specific boundaries.
- For Konnect work, prefer the shared
kong-konnectMCP server for live inspection when available, but keep fallback paths throughkongctl, declarative config, logs, or user-provided artifacts. - Preserve the repository's existing toolchain instead of forcing migration
between
decK,kongctl, and Terraform. - Keep domain skills focused on reasoning quality and handoffs instead of absorbing full tool-execution playbooks.
- For Konnect work, prefer the shared
- Produce the smallest useful authoring output.
- State whether to extend an existing skill or create a new one.
- Name the owning plugin path.
- Provide the exact
descriptiontrigger surface. - List the minimum root sections and any justified companion files with exact load conditions.
- When reviewing an existing skill, lead with the highest-risk finding and the smallest corrective move.
- Before stopping, name the main pass/fail call for trigger quality, boundary discipline, reasoning quality, root bloat, reference discipline, and reference bloat.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 167 lines · 51 tokens per session scan A d65a6d27ca0b
kong-skill-authoring is a skill published in the GitHub repository Kong/ai-marketplace (5 stars, last pushed 22d ago), licensed MIT. It adds 51 tokens to every session and 1,770 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-communication-protocol
Open protocol for AI agent interoperability enabling standardized communication between agents, applications, and humans across different frameworks.
pre-merge
The CI gate. Takes a feature branch from "eng says done" to "PR open against staging with green checks". Runs the project's preflight-resolved pipeline from devkit/policy.json components[]: sync → parallel correctness + security waves → coverage → regression tail → security/migration → PRD-consistency → open PR. Emits…
intake
The planning front-door. Captures feature ideas and bugs as graded rows in the root INTAKE.md ledger. Use it when the user says "log an idea", "capture a bug", "add to the backlog", "note this down", "track this feature", or invokes /intake. Owns the requirements interview — fleshes out thin ideas, proactively…
merge
The ship gate — the only skill that merges. --staging merges the feature→staging PR on green CI, deploys, verifies, emits a human test script and stamps the staging sign-off on approval. --production ships the double-confirmed release to main and deploys production. Never self-certifies staging; nothing reaches main…
msg
Root menu for msg skills, plus harness modes. --init is the one-time project bootstrap — use it when the user says "initialise project", "bootstrap repo", "set up the framework", "start a new project", or asks to set up project structure in an empty repo. Other modes: --init-staging (add a staging branch), --update…
plan-pm
Principal PM skill — the autonomous PRD writer. Consumes a graded, fleshed-out row from the INTAKE.md backlog (idea, goal, type, grade) and drafts the full PRD solo — feature/acceptance table, edge cases, error handling — saved to features/planned/prd-[n]-[feature-slug]/. The requirements interview lives in /intake…