Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LerianStudio/ring --skill using-lib-commonsgit clone --depth 1 https://github.com/LerianStudio/ringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lerianstudio/ring/using-lib-commons)<a href="https://agentmods.dev/skills/lerianstudio/ring/using-lib-commons"><img src="https://agentmods.dev/badge/skills/lerianstudio/ring/using-lib-commons.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 61 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02310 |
| Opus 5 | $0.00049 | $0.01155 |
| Sonnet 5 | $0.00020 | $0.00462 |
| Haiku 4.5 | $0.00010 | $0.00231 |
Grade A, and why
ring:using-lib-commons scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ring:using-lib-commons
Scope note (lib-observability v1.0.0): The observability layer —
log,metrics,tracing,zap,assert,runtime(panic recovery),redaction, and OTel attribute constants — moved out of lib-commons intogithub.com/LerianStudio/lib-observabilityas of v1.0.0. lib-commons v5 keeps deprecated shims for back-compat, but this skill is no longer the canonical reference for those packages. For observability work, dispatch [[using-lib-observability]] (top-level) or its dedicated sub-skills [[using-tracing]] / [[using-runtime]] / [[using-assert]]. This skill now focuses on lib-commons's non-observability surface: lifecycle (commons.Launcher), outbox repository (writer side lives in [[using-lib-streaming]]), circuit breakers, tenant management, idempotency, security/TLS, database connections, messaging (RabbitMQ command queues; events go through [[using-lib-streaming]]), HTTP toolkit.
When to use
Sweep mode:
- "Sweep the codebase for lib-commons opportunities"
- "Find where we could use lib-commons instead of DIY"
- "Audit this service for lib-commons compliance"
- "Identify lib-commons migration opportunities"
Reference mode:
- Need to understand what lib-commons provides
- Looking for the right package/API for a task
- Setting up a new service that uses lib-commons
- Need correct constructor/initialization patterns
- Working with multi-tenancy (tenant-manager subsystem)
- Working with event-driven tenant discovery
Skip when
- Working on non-Go services
- Working on frontend code
- Target codebase is Ring itself (no lib-commons dependency)
Related
Similar: ring:using-dev-team, ring:planning-backend-refactor Observability layer (moved to lib-observability): [[using-lib-observability]], [[using-tracing]], [[using-runtime]], [[using-assert]] Adjacent libs: [[using-outbox]], [[using-lib-streaming]], [[using-lib-systemplane]]
Mode Selection
| Request Shape | Mode |
|---|---|
| "Sweep / audit / find opportunities / migrate to lib-commons" | Sweep |
| "What does lib-commons provide for X?" | Reference |
| "How do I initialize Y from lib-commons?" | Reference |
| "Replace our DIY webhook delivery with lib-commons" | Sweep |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 180 lines · 98 tokens per session scan A 888ff5f5c1b9
ring:using-lib-commons is a skill published in the GitHub repository LerianStudio/ring (211 stars, last pushed 19d ago), licensed Apache-2.0. It adds 98 tokens to every session and 2,310 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ds-backend
Backend architecture — API design, database schema, authentication, data pipelines. Use when designing or reviewing a backend, REST/GraphQL APIs, data models, auth flows, or ingest/ETL pipelines.
execution/backend-executor
Internal: Backend Executor. Implements API routes, services, business logic, auth. Read spec and segment. Write evidence on completion.
execution/integration-executor
Internal: Integration Executor. Wires components together, connects external APIs, handles plumbing. Write evidence on completion.
sdd-apply
Skill "sdd-apply" from Gentleman-Programming/gentle-ai, covering execution role, language domain contract, purpose, what you receive and execution and persistence contract.
memstack-development-api-designer
Use this skill when the user says 'design API', 'API endpoints', 'REST API', 'API designer', 'route structure', 'API architecture', or is designing RESTful API routes, request/response schemas, and endpoint organization. Do NOT use for API security audits or database design.
memstack-security-api-audit
Use this skill when the user says 'audit API', 'check API security', 'API routes security', 'endpoint audit', 'check my routes', or needs to verify API route protection. Reviews API endpoints for authentication, authorization, and input validation gaps. Do NOT use for frontend security headers or dependency scanning.