Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kyh/vibedgames --skill gamepadgit clone --depth 1 https://github.com/kyh/vibedgamesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kyh/vibedgames/gamepad)<a href="https://agentmods.dev/skills/kyh/vibedgames/gamepad"><img src="https://agentmods.dev/badge/skills/kyh/vibedgames/gamepad/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kyh/vibedgames/gamepad"><img src="https://agentmods.dev/badge/skills/kyh/vibedgames/gamepad.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 270 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.02385 |
| Opus 5.5 | $0.00013 | $0.00954 |
| Sonnet 5.5 | $0.00007 | $0.00477 |
| Haiku 4.5 | $0.00003 | $0.00238 |
Grade A, and why
gamepad scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vibedgames Gamepad
Add on-screen touch controls — a floating analog joystick plus action buttons — and physical controller input to any browser game with @vibedgames/gamepad. Framework-agnostic core, with drop-in adapters that wire the input and render the overlay for you: one for Phaser, one for the DOM (Three.js, canvas, anything else).
Install
npm install @vibedgames/gamepad
phaser is an optional peer dependency — only needed if you use the /phaser adapter. The core and /dom adapter have no engine dependency.
Three entry points
@vibedgames/gamepad/phaser—attachVirtualGamepad(scene, options)for Phaser games@vibedgames/gamepad/dom—attachDomGamepad(options)for everything else (Three.js, canvas, vanilla). Prefer this over the raw core.@vibedgames/gamepad— framework-agnosticVirtualGamepadclass (custom event routing / custom renderers only) andPhysicalGamepad
Core concepts
- Floating stick — the first free touch anchors a virtual analog stick wherever the finger lands; dragging from the anchor steers. Reads back as
angle+magnitude(0–1 thrust after a dead zone). - Action buttons — either fixed (a circle pinned on-screen, e.g. a bottom-right bomb/jump button) or "rest" (no position — catches any touch that isn't the stick or a fixed button; this is the "any second finger fires" model).
- Touch is the overlay. The adapter ignores the mouse, so a desktop game keeps whatever controls it already had.
isTouchflips true the first time a finger lands — use it to switch control schemes or swap an on-screen hint. update()once per frame is mandatory (either adapter). It reconciles touches whoseupwas lost (finger slid off-canvas) and publishesjustPressed/justReleasededges. Skip it and the joystick sticks on.- Held vs edge: movement and continuous fire read
isButtonDown(id)/getStick()each frame; one-shot actions (bomb, jump) useonButtonDown(id)orjustPressed(id)afterupdate().
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -147 lines · -66 tokens per session 9b896b32e1af
- 1mo ago First seen · 276 lines · 99 tokens per session scan A db6c7d6b8b89
gamepad is a skill published in the GitHub repository kyh/vibedgames (61 stars, last pushed today), licensed MIT. It adds 33 tokens to every session and 2,385 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verify
Build/launch/drive recipe for verifying apps/docs changes at runtime (demos, docs pages, llms.txt).
common-store-changelog
Generate user-facing release notes for the App Store and Google Play from git history (App Store <=4000 chars, Google Play <=500). Use when generating release notes, app store changelog, play store release, or "what's new" text for a mobile app.
android-navigation-3
Install and migrate to Jetpack Navigation 3. Use when implementing Navigation 3 patterns including NavDisplay, NavKey routes, deep links, multiple backstacks, scenes (dialogs, bottom sheets), or migrating from Navigation 2.
mobile-web-app
Add router-agnostic, native app-like page transitions to mobile web apps with SSGOI. Explore live drill, sheet, slide, and zoom demos at https://ssgoi.dev. Use when building or improving a mobile web app's routed page structure, layouts, or transitions, or when a project uses SSGOI or an @ssgoi package.
quality-engineering-appium-mcp
Drives iOS/Android mobile devices via Appium MCP. Runs a preflight, picks local emulator/simulator/USB or a device cloud, captures screenshots/page source into a named evidence dir. Use for verifying mobile bugs, E2E tests, and navigating real device clouds (LambdaTest/BrowserStack).
quality-engineering-playwright-cli
Standardizes token-efficient browser automation via playwright-cli, with Playwright MCP as the fallback driver. Runs a preflight, picks the driver rung, captures aria snapshots/console/screenshots into a named evidence dir. Use for web verification, navigation, and capturing snapshots/logs.