Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add medy-gribkov/arcana --skill npm-packagegit clone --depth 1 https://github.com/medy-gribkov/arcanaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/medy-gribkov/arcana/npm-package)<a href="https://agentmods.dev/skills/medy-gribkov/arcana/npm-package"><img src="https://agentmods.dev/badge/skills/medy-gribkov/arcana/npm-package/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/medy-gribkov/arcana/npm-package"><img src="https://agentmods.dev/badge/skills/medy-gribkov/arcana/npm-package.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.03296 |
| Opus 5 | $0.00056 | $0.01648 |
| Sonnet 5 | $0.00022 | $0.00659 |
| Haiku 4.5 | $0.00011 | $0.00330 |
Grade A, and why
npm-package scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 402 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior JavaScript package author who ships library code that works everywhere with zero configuration headaches for consumers.
Use this skill when
- Creating a new npm package from scratch
- Configuring package.json exports for dual ESM/CJS
- Setting up tsup or unbuild for library bundling
- Managing a monorepo with pnpm workspaces
- Publishing packages to npm (public or private)
- Debugging "Cannot find module" or "ERR_REQUIRE_ESM" in consumers
- Setting up changesets for automated versioning
Package.json: The Complete Field Reference
{
"name": "@scope/my-lib",
"version": "1.0.0",
"description": "One line, searchable on npm",
"license": "MIT",
"author": "Name <email>",
"repository": { "type": "git", "url": "https://github.com/user/repo" },
"type": "module", // ESM by default. Omit for CJS-first.
"main": "./dist/index.cjs", // CJS entry (Node <12, bundlers fallback)
"module": "./dist/index.js", // ESM entry (bundlers: webpack, rollup)
"types": "./dist/index.d.ts", // TypeScript declarations
"exports": { // Modern entry point resolution (Node 12+)
".": {
"import": { "types": "./dist/index.d.ts", "default": "./dist/index.js" },
"require": { "types": "./dist/index.d.cts", "default": "./dist/index.cjs" }
},
"./utils": {
"import": { "types": "./dist/utils.d.ts", "default": "./dist/utils.js" },
"require": { "types": "./dist/utils.d.cts", "default": "./dist/utils.cjs" }
}
},
"files": ["dist", "README.md"], // Whitelist what gets published. Nothing else ships.
"bin": { "my-cli": "./dist/cli.js" },
"sideEffects": false, // Enables tree-shaking in bundlers
"engines": { "node": ">=18" },
"keywords": ["relevant", "search", "terms"],
"scripts": {
"build": "tsup",
"dev": "tsup --watch",
"prepublishOnly": "pnpm build",
"release": "changeset publish"
}
}
Critical ordering in exports: types MUST come first in each condition block. Node resolves top-down and TypeScript needs to find declarations before the runtime file.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 402 lines · 112 tokens per session scan A 6d8c7f7417a8
npm-package is a skill published in the GitHub repository medy-gribkov/arcana (1 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 112 tokens to every session and 3,296 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hue
Meta-skill that generates new design language skills. Works on Claude Code and Codex. Use when the user says 'create a design skill', 'generate design language', 'new design system skill', 'design skill inspired by X', 'design skill from this screenshot', '/hue', or 'use hue'. Also triggers for 'remix my design skill'…
layout-discipline
A set of rules for keeping AI-generated web pages visually consistent, including their text sizes, spacing, alignment, cards, and colors.
accessibility-checker
Audit and fix accessibility issues — WCAG 2.2 compliance, ARIA labels, color contrast, keyboard navigation, and screen-reader compatibility.
ab-test-designer
Design and analyze A/B tests — sample sizes, significance testing, multiple comparisons, and results interpretation.
action-tracker
Track and manage action items — owners, deadlines, status updates, and escalation workflows.
alerting-config
Design alert configurations — thresholds, severity levels, routing, de-duplication, and escalation policies.