Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mgiovani/cc-arsenal --skill find-skillsgit clone --depth 1 https://github.com/mgiovani/cc-arsenalWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mgiovani/cc-arsenal/find-skills)<a href="https://agentmods.dev/skills/mgiovani/cc-arsenal/find-skills"><img src="https://agentmods.dev/badge/skills/mgiovani/cc-arsenal/find-skills/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mgiovani/cc-arsenal/find-skills"><img src="https://agentmods.dev/badge/skills/mgiovani/cc-arsenal/find-skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01704 |
| Opus 5 | $0.00043 | $0.00852 |
| Sonnet 5 | $0.00017 | $0.00341 |
| Haiku 4.5 | $0.00009 | $0.00170 |
Grade A, and why
find-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Find Skills
Discover and install third-party agent skills from the open Agent Skills ecosystem powered by skills.sh.
Overview
The Agent Skills format is an open standard for packaging procedural knowledge, workflows, and tools that AI agents load on demand. The npx skills CLI (maintained by Vercel Labs) serves as "npm for AI agents" -- enabling discovery and installation of community skills from any Git repository.
skills.sh is the public directory and leaderboard for the ecosystem, hosting thousands of skills across categories like frontend, backend, DevOps, and more.
Before installing a third-party skill, check ls skills/ in this repo (or run /find-skills again after browsing) -- cc-arsenal may already cover the same ground, and a hardcoded list here would just go stale.
Ask First, Never Mutate to "Show" Something
add, remove/rm, and update all touch the user's real filesystem (project .claude/skills/ or global ~/.claude/skills/) -- a wrong guess costs the user real state, not a free re-run. Two hard stops, both end the turn on a question rather than acting and reporting after:
- Scope or target is ambiguous. If it isn't clear which skill/repo to install, or whether it belongs at project vs. global scope, end your response with the clarifying question. Don't run
npx skills addfirst and confirm after, and don't install to a throwaway/local mock "just to show the flow" -- that still runs a real command against the user's real directories. Ask, stop, and install only in a later turn once the user answers. - Any removal, one skill or all of them. Removal is destructive and not undoable via the CLI. Run
npx skills list(and-gif scope is unclear) to show what's actually installed, then end your response asking the user to confirm exactly what gets removed. Runremove/rm/--allonly in a later turn, after the user replies with an explicit yes. The request is never the confirmation: "remove the foo skill, I don't use it anymore" names the action but does not green-light it -- if you catch yourself reasoning "the user already confirmed by naming it", that reasoning is exactly the failure this rule exists to stop.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 154 lines · 85 tokens per session scan A 34d13ec7449c
find-skills is a skill published in the GitHub repository mgiovani/cc-arsenal (8 stars, last pushed 2d ago), licensed MIT. It adds 85 tokens to every session and 1,704 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gitlab
Agent-callable GitLab tools — manage issues and merge requests, review diffs, commit files, run pipelines, and search. Use when the user mentions GitLab or wants to review or merge an MR, commit code, run CI, or manage issues — even if they don't name GitLab explicitly.
alpaca
Agent-callable Alpaca trading tools — place and manage stock, crypto, and options orders, read account balances, positions, and portfolio history, look up assets and market hours, and read watchlists. Use when the user mentions Alpaca or wants to trade or inspect a brokerage account, even if they don't name Alpaca…
dataforseo
Agent-callable DataForSEO tools — Google SERP results, keyword and domain analytics, backlinks, Google Maps business data, on-page audits, and AI-search visibility (LLM answers + brand mentions). Use when the user wants SEO or AI-search data, even if they don't name DataForSEO.
discord
Agent-callable Discord tools — send and manage messages, start threads and forum posts, manage channels, members, and roles, and post via webhooks. Use when the user mentions Discord or wants to post, read, or manage Discord servers, channels, or members, even if they don't name Discord explicitly.
google-analytics
Agent-callable Google Analytics 4 (GA4) tools — run analytics reports, discover the dimensions and metrics a property supports, navigate accounts and properties, manage key events and custom dimensions/metrics, and send Measurement Protocol events. Use when the user mentions Google Analytics or GA4, or wants…
google-docs
Agent-callable Google Docs tools — create, read, export, and find documents; edit text, formatting, images, and page style. Use when the user mentions Google Docs or wants to create, read, search, or edit document content, even if they don't name Google Docs explicitly.