Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lirantal/nodejs-cli-apps-best-practices/nodejs-cli-best-practicesnpx skills add lirantal/nodejs-cli-apps-best-practices --skill nodejs-cli-best-practicesgit clone --depth 1 https://github.com/lirantal/nodejs-cli-apps-best-practicesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00181 | $0.02031 |
| Opus 5 | $0.00090 | $0.01015 |
| Sonnet 5 | $0.00036 | $0.00406 |
| Haiku 4.5 | $0.00018 | $0.00203 |
Grade A, and why
nodejs-cli-best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
The source is not reproduced here
Licensed CC-BY-SA-4.0
The repository is licensed CC-BY-SA-4.0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 181 lines · 181 tokens per session scan A 3921087ee614
nodejs-cli-best-practices is a skill published in the GitHub repository lirantal/nodejs-cli-apps-best-practices (4,111 stars, last pushed 1mo ago), licensed CC-BY-SA-4.0. It adds 181 tokens to every session and 2,031 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fanyi
用命令行工具 fanyi(别名 fy)做中英互译与查词,一次返回词典(iciba、youdao)和大模型三方结果。适用于单词、短语、习语谚语、单句短句的中英翻译,以及查释义、音标、例句、相关词。触发场景如"翻译一下 xxx"、"xxx 是什么意思"、"xxx 用英语怎么说"、"和谐 翻译成英文"——即使没说"用 fanyi"也应优先用本 skill,比口头翻译更准更全。不适用:长句、段落、整篇文章等长文本翻译(改由模型直接翻),以及非中英语言、文案润色、写代码等需求。.
debugging-output-and-previewing-html-using-ray
Use when user says "send to Ray," "show in Ray," "debug in Ray," "log to Ray," "display in Ray," or wants to visualize data, debug output, or show diagrams in the Ray desktop application.
Shade dropdown surface contract
DropdownMenu, Select, and Popover share one visual recipe (bg-surface-elevated-2 + border-border/60 dark:border-border/30 + shadow-md). Change them together. Trigger when editing any of those three Shade files.
Shade ShadCN install
Guardrails for running pnpm dlx shadcn@latest add in Shade — never overwrite existing components, fresh branch first, swap raw colours for semantic tokens after integrating. Trigger when the user proposes a shadcn add, or when a fresh ShadCN-shaped file lands in apps/shade/src/components/ui.
Add Admin API Endpoint
Add a new endpoint or endpoints to Ghost's Admin API at ghost/api/admin/.
Workspace Data Analyst
Analyze CSV files in the workspace and summarize insights.