Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kyh/vibedgames --skill gamepadgit clone --depth 1 https://github.com/kyh/vibedgamesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kyh/vibedgames/gamepad)<a href="https://agentmods.dev/skills/kyh/vibedgames/gamepad"><img src="https://agentmods.dev/badge/skills/kyh/vibedgames/gamepad.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 270 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.02903 |
| Opus 5 | $0.00049 | $0.01452 |
| Sonnet 5 | $0.00020 | $0.00581 |
| Haiku 4.5 | $0.00010 | $0.00290 |
Grade A, and why
gamepad scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 276 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vibedgames Gamepad
Add on-screen touch controls — a floating analog joystick plus action
buttons — to any browser game with @vibedgames/gamepad. Framework-agnostic
core, with drop-in adapters that wire the input and render the overlay for
you: one for Phaser, one for the DOM (Three.js, canvas, anything else).
Install
npm install @vibedgames/gamepad
phaser is an optional peer dependency — only needed if you use the
/phaser adapter. The core and /dom adapter have no engine dependency.
Three entry points
@vibedgames/gamepad/phaser—attachVirtualGamepad(scene, options)for Phaser games@vibedgames/gamepad/dom—attachDomGamepad(options)for everything else (Three.js, canvas, vanilla). Prefer this over the raw core.@vibedgames/gamepad— framework-agnosticVirtualGamepadclass, for custom event routing / custom renderers only
Core concepts
- Floating stick — the first free touch anchors a virtual analog stick wherever the finger lands; dragging from the anchor steers. Reads back as
angle+magnitude(0–1 thrust after a dead zone). - Action buttons — either fixed (a circle pinned on-screen, e.g. a bottom-right bomb/jump button) or "rest" (no position — catches any touch that isn't the stick or a fixed button; this is the "any second finger fires" model).
- Touch is the overlay. The adapter ignores the mouse, so a desktop game keeps whatever controls it already had.
isTouchflips true the first time a finger lands — use it to switch control schemes or swap an on-screen hint.
Touch routing
Each touch-down is routed in order: fixed buttons → the stick → a "rest" button. This one model covers both common layouts — a stick + rest "fire" button (twin-stick: move one thumb, any other finger fires), and a stick + fixed action button (grid/platformer: move with the stick, tap to bomb/jump). Both are shown below.
Phaser quickstart (twin-stick shooter)
import { attachVirtualGamepad } from "@vibedgames/gamepad/phaser";
class GameScene extends Phaser.Scene {
private gamepad!: ReturnType<typeof attachVirtualGamepad>;
create() {
this.gamepad = attachVirtualGamepad(this, {
buttons: [{ id: "fire" }], // rest button: any non-stick finger fires
onFirstTouch: () => this.hint?.destroy(),
});
this.events.once(Phaser.Scenes.Events.SHUTDOWN, () => this.gamepad.destroy());
}
update() {
this.gamepad.update(); // ALWAYS call once per frame: reconciles + redraws
const stick = this.gamepad.getStick();
if (stick.active && !stick.inDeadZone) {
this.steer(stick.angle, stick.magnitude); // radians, 0–1
}
if (this.gamepad.isButtonDown("fire")) this.shoot();
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 276 lines · 99 tokens per session scan A db6c7d6b8b89
gamepad is a skill published in the GitHub repository kyh/vibedgames (55 stars, last pushed today), licensed MIT. It adds 99 tokens to every session and 2,903 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
common-store-changelog
Generate user-facing release notes for the App Store and Google Play from git history (App Store <=4000 chars, Google Play <=500). Use when generating release notes, app store changelog, play store release, or "what's new" text for a mobile app.
android-navigation-3
Install and migrate to Jetpack Navigation 3. Use when implementing Navigation 3 patterns including NavDisplay, NavKey routes, deep links, multiple backstacks, scenes (dialogs, bottom sheets), or migrating from Navigation 2.
verify
Build/launch/drive recipe for verifying apps/docs changes at runtime (demos, docs pages, llms.txt).
quality-engineering-appium-mcp
Drives iOS/Android mobile devices via Appium MCP. Use for verifying mobile bugs, E2E tests, and navigating real device clouds (LambdaTest/BrowserStack).
quality-engineering-playwright-cli
Standardizes token-efficient browser automation via playwright-cli. Use for web verification, navigation, and capturing snapshots/logs.
android-agp-upgrade
Upgrade an Android project to Android Gradle Plugin (AGP) 9. Use when migrating to AGP 9, updating Gradle build files, migrating to built-in Kotlin, or adopting the new AGP DSL.