Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add majiayu000/spellbook --skill contributorgit clone --depth 1 https://github.com/majiayu000/spellbookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/majiayu000/spellbook/contributor)<a href="https://agentmods.dev/skills/majiayu000/spellbook/contributor"><img src="https://agentmods.dev/badge/skills/majiayu000/spellbook/contributor.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 180 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.02375 |
| Opus 5 | $0.00056 | $0.01188 |
| Sonnet 5 | $0.00022 | $0.00475 |
| Haiku 4.5 | $0.00011 | $0.00237 |
Grade A, and why
contributor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Contributor
Automated open source contribution workflow that takes you from a GitHub repo URL to merged PRs, with built-in safeguards against common contribution failures.
Why this skill exists
Open source contributions fail for predictable reasons: fixing in the wrong layer (your PR gets closed because the maintainer preferred an upstream fix), colliding with other contributors, not following project conventions, or over-engineering a simple fix. This workflow prevents each of those failures through systematic pre-checks.
Phase 1: Reconnaissance
Before writing any code, gather intelligence about the project and its contribution landscape.
1.1 Identify the target
Ask the user for:
- The GitHub repo URL (e.g.,
pydantic/pydantic-ai) - Their GitHub username and email for commits
- Any specific issue they want to work on (or ask to scan for available ones)
1.2 Scan for available issues
Use gh CLI to find issues worth contributing to:
# Get open issues with metadata
gh issue list -R <owner>/<repo> --state open --limit 50 \
--json number,title,labels,assignees,comments
# Check for competing PRs on each candidate
gh pr list -R <owner>/<repo> --state open \
--search "<issue_number> in:title,body"
Filter criteria (apply in order):
- No assignee
- No open PR already fixing it (check both linked PRs and title/body search)
- Fewer than 5 competing PRs
- Prefer labels:
bug,good first issue,help wanted - Prefer issues with maintainer comments suggesting a fix direction
1.3 Deep-read issue comments
For each candidate issue, read the full comment thread:
gh issue view <number> -R <owner>/<repo> --json body,comments
Extract:
- Maintainer fix direction: Do they prefer fixing here or in an upstream dependency?
- Suggested approach: Any code pointers, file references, or architectural guidance?
- Blockers: Is this waiting on another PR or release?
- Who's working on it: Even without assignment, someone might have commented "I'll take this"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 284 lines · 111 tokens per session scan A 0d349af56664
contributor is a skill published in the GitHub repository majiayu000/spellbook (276 stars, last pushed 3d ago), licensed MIT. It adds 111 tokens to every session and 2,375 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
repo-guidance
Navigate the Composio SDK monorepo, branch and PR workflow, repo layout, generated-file boundaries, changesets, and shared maintenance rules. Use when work spans multiple packages, when deciding where code belongs, when preparing a PR, or when the user asks about repository conventions rather than a specific SDK…
python-release
Handle Python SDK release, build, bump, packaging metadata, PyPI client pin, uv.lock, nox/build workflow, and publish verification changes. Use for Python release process work or dependency pin bumps; do not use for ordinary Python feature implementation.
pneuma-session
Instructions for renaming an active Pneuma session and replacing its default preview with a useful title and summary. A Pneuma session is one work area inside a larger project.
docs
Use when documentation generally needs to catch up with a branch before pushing or merging, covering internal developer docs, external customer-facing docs, and release notes together — "update the docs", "do a docs pass before I merge", "make sure everything's documented". Prefer this when no single documentation…
ring:generating-release-guides
Generating an internal Operations-facing update/migration guide from the git diff between two refs, documenting per-change client impact, deploy ordering, monitoring, and rollback notes in English, pt-br, or both. Use when preparing a version release or recording what changed for the Ops team. Runs read-only by…
procoder
Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…