Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MikkoParkkola/nab --skill oreillygit clone --depth 1 https://github.com/MikkoParkkola/nabWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mikkoparkkola/nab/oreilly)<a href="https://agentmods.dev/skills/mikkoparkkola/nab/oreilly"><img src="https://agentmods.dev/badge/skills/mikkoparkkola/nab/oreilly.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 79 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.01052 |
| Opus 5 | $0.00060 | $0.00526 |
| Sonnet 5 | $0.00024 | $0.00210 |
| Haiku 4.5 | $0.00012 | $0.00105 |
Grade A, and why
oreilly scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
O'Reilly Learning Platform Skill
Decision tree
Q: "What's the canonical book on X?" → fulcrum:oreilly_books_search (v1)
Q: "Find chapters/segments about X" → fulcrum:oreilly_search (v2)
Q: "ISBN of <title>" → fulcrum:oreilly_books_search
Q: "Latest 2025 books on rust async" → fulcrum:oreilly_search + sort=date
Q: "Manning books on LLM systems" → fulcrum:oreilly_search + publishers
Q: "Hands-on patterns for KV cache" → fulcrum:oreilly_search
Q: "Compare academic vs practitioner view" → run alongside research skill
High-leverage workflows
1. Practitioner counterpart to academic research
When research skill returns a SOTA paper, run a parallel
oreilly_search for the same topic. The arxiv view tells us where
the frontier is; the O'Reilly view tells us what's already in
production books / vendor-shipped patterns.
research (arxiv + S2) → "what's novel?"
oreilly_search (parallel) → "what's the deployed practice?"
gap between them → moat opportunity
2. ISBN/citation enrichment
gateway_execute("fulcrum:oreilly_books_search", {
"query": "<title> <first-author-lastname>",
"limit": 3
})
# returns ISBN-13 + canonical archive_id for citation graphs
3. Topic landscape mapping
# Get format facets + topic facets in one call
res = gateway_execute("fulcrum:oreilly_search", {
"query": "kv cache attention",
"limit": 10,
"sort": "date"
})
# res["facets"] -> top topics, top publishers, format breakdown
4. Pre-arxiv expert knowledge
Many architecture lessons (production reliability, ops patterns, cost-engineering, hardware tradeoffs) are book-only. Books predate arxiv coverage in: SRE, observability, cost engineering, security operations, distributed systems engineering. Use this skill when the topic is operational, not novel.
Auth
X-API-Key: $OREILLY_API_KEY. Stored in:
~/.claude/secrets.env~/.mcp-gateway/.env- 1Password "Claude Elite" → "O Reilly Learning Platform API"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 112 lines · 119 tokens per session scan A cea3ba3f087f
oreilly is a skill published in the GitHub repository MikkoParkkola/nab (12 stars, last pushed yesterday), licensed MIT. It adds 119 tokens to every session and 1,052 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cw-dogfood
Use when a Codewhale change needs proving in the real product, or when asked to build/install/dogfood the local binaries: stamped release build, atomic install, fresh-shell verification, and the manual QA that gates cannot cover.
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
webapp-testing
Start/reuse a local app, wait for readiness, inspect rendered state/console/network, act from observed selectors, and verify with evidence.
tui-explorer
Discover and replay terminal UI paths using agent-tui. Use when you need to launch a TUI app, explore navigation with bounded BFS, generate markdown acceptance tests, and verify those tests repeatedly. Do not use for web or desktop GUI automation.