Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/luongnv89/asm/skill-index-updaternpx skills add luongnv89/asm --skill skill-index-updatergit clone --depth 1 https://github.com/luongnv89/asmWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.03632 |
| Opus 5 | $0.00032 | $0.01816 |
| Sonnet 5 | $0.00013 | $0.00726 |
| Haiku 4.5 | $0.00006 | $0.00363 |
Grade B, and why
skill-index-updater scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "<tempRoot>" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 328 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Index Updater
You are adding new skill repository sources to the ASM (Agent Skill Manager) curated index. This is the pipeline that powers the skill catalog at https://luongnv.com/asm/ — every repo you add here becomes discoverable and installable by thousands of users.
Example
User: add github.com/anthropics/skills to the index
Skill output:
Step 1: Parsed 1 URL → anthropics/skills (NEW)
Step 2: Discovered 14 SKILL.md files
Step 3: Audit OK on 14/14, eval scores 71–94
Step 6–8: data/skill-index-resources.json + data/skill-index/anthropics_skills.json updated, catalog rebuilt
Step 10: PR #312 opened — feat(index): add anthropics/skills (14 skills)
Repo Sync Before Edits (mandatory)
Before modifying any files, pull the latest remote branch:
branch="$(git rev-parse --abbrev-ref HEAD)"
git fetch origin
git pull --rebase origin "$branch"
If the working tree is dirty: stash, sync, then pop. If origin is missing or conflicts occur: stop and ask the user before continuing.
Input
The user provides one or more GitHub repository URLs. These can be in various formats:
https://github.com/owner/repogithub.com/owner/repogithub:owner/repoowner/repo(shorthand)
Normalize all inputs to extract owner and repo.
Pipeline
Follow these steps in order. Each step has a verification check — do not proceed to the next step if verification fails.
You are the orchestrator. Steps 2 and 3 are the heavy ones, and you delegate both: each names the slice of references/ its worker needs and hands that slice over as the worker's Input. In those two steps you never clone a repo, read a SKILL.md, or run asm eval yourself, and you never open the two contract files — the workers do. (Step 7's manual-generation fallback is the one place you may call asm eval directly.)
No Agent tool? Degrade gracefully: read references/discovery-contract.md and references/audit-eval-contract.md yourself, run Steps 2 and 3 inline, in order, and say so in the Step 9 summary. The pipeline is identical; only the context cost changes.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 328 lines · 63 tokens per session scan B 0ad19584150a
skill-index-updater is a skill published in the GitHub repository luongnv89/asm (902 stars, last pushed 2d ago), licensed MIT. It adds 63 tokens to every session and 3,632 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Skill Development
This skill should be used when the user wants to "create a skill", "add a skill to plugin", "write a new skill", "improve skill description", "organize skill content", or needs guidance on skill structure, progressive disclosure, or skill development best practices for Claude Code plugins.
Hook Development
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDEPLUGINROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop…
Agent Development
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development…
writing-skills
Use when creating new skills, editing existing skills, or verifying skills work before deployment.
subagent-driven-development
Use when executing implementation plans with independent tasks in the current session.
drama-creator
创作竖屏短剧剧本，包括宏观建构、剧本创作、精准优化、创意发想。适用于从零开始创作短剧、优化现有剧本、设计故事大纲和悬念钩子.