Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/lizard-build/lizard-clinpx agentmods add skills/lizard-build/lizard-cli/coreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lizard-build/lizard-cli/core)<a href="https://agentmods.dev/skills/lizard-build/lizard-cli/core"><img src="https://agentmods.dev/badge/skills/lizard-build/lizard-cli/core/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lizard-build/lizard-cli/core"><img src="https://agentmods.dev/badge/skills/lizard-build/lizard-cli/core.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00152 | $0.09593 |
| Opus 5.5 | $0.00061 | $0.03837 |
| Sonnet 5.5 | $0.00030 | $0.01919 |
| Haiku 4.5 | $0.00015 | $0.00959 |
Grade D, and why
lizard-core scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Lizard runs sandboxes and hosts apps, services, agents and managed databases. All capabilities are exposed through the `lizard` CLI (npm package `@lizard-build/cli`). This skill teaches you to drive it. If `lizard` isn't Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
Lizard runs sandboxes and hosts apps, services, agents and managed databases. All capabilities are exposed through the `lizard` CLI (npm package `@lizard-build/cli`). This skill teaches you to drive it. If `lizard` isn't Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Lizard runs sandboxes and hosts apps, services, agents and managed databases. All capabilities are exposed through the `lizard` CLI (npm package `@lizard-build/cli`). This skill teaches you to drive it. If `lizard` isn't How it starts
The opening of the file, as written. The whole thing — 326 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lizard platform
Lizard runs sandboxes and hosts apps, services, agents and managed databases. All capabilities are exposed through the lizard CLI (npm package @lizard-build/cli). This skill teaches you to drive it. If lizard isn't on PATH, install it: curl -fsSL https://lizard.build/install.sh | bash on macOS and Linux (no Node.js or sudo needed; if lizard is still not found, call ~/.lizard/bin/lizard), irm https://lizard.build/api/cli/install.ps1 | iex in Windows PowerShell, or npm install -g @lizard-build/cli anywhere. The install script ends by running lizard login, so its output may already hold the sign-in links: see Sign-in.
This guide covers the whole platform. Three references go deeper; read one only when the task needs that depth:
lizard skills get core --ref sandboxes --json: templates, commands, files and ports in depth, lifetime, sizes, shell, coding agents in a sandbox, desktop (computer use), volumes, snapshots and pause/resume.lizard skills get core --ref deploys --json: how builds are chosen, git and upload deploys, service fields, worker mode, secret precedence and scoping, addon variables, multi-step recipes.lizard skills get core --ref sdk --json: building with Lizard from code through Lizard SDK (TypeScript, Python): sandboxes inside your own product, per-user workspaces and scoped keys, platform APIs.
If $ARGUMENTS is non-empty, treat it as the user's request and act on it. If empty, ask what they want to do on Lizard.
Execution rules
- Prefer the
lizardCLI. Don't call the Lizard HTTP API yourself; for something the CLI does not expose, ask the user. Using a database, S3 or a deployed app through its own URL and credentials is fine. - Always pass
--jsonon non-interactive calls. The CLI also switches to JSON by itself when stdout isn't a TTY. - For an unfamiliar command, run
lizard <cmd> --help --jsonfirst: never guess flag shapes. See Discovery. - Resolve context before any change:
lizard status --jsonshows whether this exact folder is linked.linked: falsemeans commands go to the default project; pass--projectwhen it matters. Confirm the project, service or sandbox you target. - A network error (
fetch failed,UND_ERR_SOCKET,ECONNRESET) is not an answer: run the command again. Before repeating a create, check withlist/psthat the first attempt did not land. - For destructive actions (delete a service, sandbox, volume or project, drop an addon, overwrite a project-wide secret, restart production), confirm with the user first. Without a terminal the CLI never asks:
sandbox rm,volume delete,keys deleteandworkspace rmdelete at once;service,project,secretsanddomaindeletes and billing changes refuse until you add-y. Add-yonly after the user agrees.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +11 lines 79babb9c5752
- 5d ago Changed · +9 lines 1fb433741720
- 7d ago Changed · -242 lines 9f67f242e2a3
- 8d ago Changed · +98 lines · -102 tokens per session 889f6645e5ce
- 10d ago Changed · +27 lines · -1 tokens per session 13ef6ab4ad98
- 12d ago Changed · +2 lines 3149a432c065
- 14d ago Changed · +8 lines · +7 tokens per session scan A → D 3dffbaa03313
- 19d ago Changed · +64 lines 9448bb38ab9a
- 21d ago Changed · +22 lines 5fb8f69be83b
- 25d ago First seen · 327 lines · 248 tokens per session scan A f5277e78fe32
lizard-core is a skill published in the GitHub repository lizard-build/lizard-cli (4 stars, last pushed today), licensed MIT. It adds 152 tokens to every session and 9,593 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
04-security
A security and operations guide for deploying Dify, an open-source platform for building AI applications, in production.
fly-io
Use when deploying or operating an app on Fly.io — writing fly.toml, placing Machines in regions near users, attaching Volumes, managing secrets, or picking a scaling lever (autostop/autostart, scale count, fly-replay). NOT choosing which host to deploy on (that is deployment), NOT a git-push PaaS with no regions…
netlify
Use when deploying or operating a site on Netlify — writing or fixing netlify.toml, authoring Functions or Edge Functions, redirects, rewrites and headers, env vars per deploy context, and shipping via the Netlify CLI. NOT deploying to Vercel (that is vercel).
huawei-cloud-deployment-task-management
Huawei Cloud CloudDeploy (CodeArts Deploy / 部署) management, execution, and failure analysis using the KooCLI hcloud command-line client. Covers deploy application listing and creation, deployment task listing/detail/creation, task start, task deletion, deployment failure root-cause analysis (agent offline, timeout…
frontmcp-deployment
Use when deploying, building for production, packaging, or shipping a FrontMCP server. Covers build targets (node, cli SEA binary, browser, embeddable SDK, mcpb archive for Claude Desktop, serverless) and deploying to Vercel (with Vercel KV), AWS Lambda (API Gateway, SAM, CDK), Cloudflare Workers (KV, D1, Durable…
development-workflow
Orchestrates the complete Falcon Foundry app lifecycle from requirements through deployment. TRIGGER when user asks to "create a Foundry app", "build a Foundry app", "plan a Foundry app", runs any foundry apps CLI command, or discusses Foundry app architecture. DO NOT TRIGGER when user is working on a specific…