Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mislavjc/stoop/stoop-apinpx skills add mislavjc/stoop --skill stoop-apigit clone --depth 1 https://github.com/mislavjc/stoopWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.02665 |
| Opus 5 | $0.00041 | $0.01333 |
| Sonnet 5 | $0.00016 | $0.00533 |
| Haiku 4.5 | $0.00008 | $0.00266 |
Grade A, and why
stoop-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST https://stoop.run/api/sites \ How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publishing a stoop site over HTTP
One authenticated POST publishes a static site and returns its URL. No browser session, no zip, no filesystem, no terminal — for code that needs to put a page on the web while it runs.
Writing any platform.* call? Load the stoop-platform skill first — it
is the full SDK surface, and guessing at this API produces a page that looks
right and silently loses data.
First: should this be a page at all?
| surface | fits | example |
|---|---|---|
| a short reply | a sentence, a number, a yes or no | "all three deploys are green" |
| a long document | prose read top to bottom, or edited afterwards | a postmortem, a spec |
| a page | anything whose layout carries meaning | a dashboard, a sortable table, a chart, a comparison grid |
The test is whether the layout carries meaning. Publish because reading the thing as text would lose something — not because the answer felt important. A paragraph you are proud of is still a paragraph; send it as a reply.
The call
curl -X POST https://stoop.run/api/sites \
-H "authorization: Bearer $STOOP_API_KEY" \
-H "content-type: application/json" \
-d '{"name":"deploy-health","files":{"index.html":"<h1>hi</h1>"}}'
The response carries the site url, and findings (read them — see
below). Limits: 50 files, 25 MB total.
The key
The user mints it once with npx @stoop/cli keys create <name>, and it is
shown only at creation. Ask them to run it — like login, it needs
their account, so do not run it yourself. Read the secret from the
environment; never hold it in source.
A key writes only inside its own namespace: a key named release-bot
reaches release-bot-* and nothing else, so the call above lands at
release-bot-deploy-health.stoop.run.
Never start the name with your key's prefix
The namespace is added for you. So do not send release-bot-deploy-health
even when the human says "call it release-bot-deploy-health" — you would be
asking for release-bot-release-bot-deploy-health. The server strips one
redundant prefix, so this is no longer a broken URL, but it is still the
difference between the name you meant and one you did not.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 260 lines · 82 tokens per session scan A 55738e992ba3
stoop-api is a skill published in the GitHub repository mislavjc/stoop (2 stars, last pushed 1mo ago), licensed MIT. It adds 82 tokens to every session and 2,665 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-issue-workflow
How to start work on a GitHub issue in the munkel repo — check for an existing draft PR and the issue's assignee first to avoid duplicating work someone already owns, claim the issue by assigning it, then open a draft PR linked with "Closes.
munkel
Send ephemeral end-to-end-encrypted messages that appear in friends' MacBook notches, via the munkel CLI (macOS). Use when the user wants to message, ping, or notify someone in a Munkel channel, broadcast to a channel, or list Munkel channels and members.
sharehtml-collaboration
Use when a user wants to deploy, update, diff, pull, or review feedback on documents managed with the sharehtml CLI. This skill covers safe deploy workflows, reviewing unresolved comments, finding documents by name with sharehtml list, and presenting diffs in human language before overwriting. Keep documents private…
frontend-design-landing-page
Marketing landing page and conversion-focused product page reference. Use this skill when building hero sections, feature grids, pricing pages, testimonials, CTAs, footers, navigation bars, or any public-facing marketing surface. Covers a warm, professional, developer-friendly design language (cream backgrounds…
frontend-design-saas
S-tier SaaS dashboard and product UI reference. Use this skill when building application shells, data tables, settings panels, billing pages, dashboards, auth flows, admin tools, or any internal/customer-facing SaaS product UI. Inspired by Stripe, Linear, Vercel, Airbnb, Notion. Covers neutral-led design tokens…
cloudflare-bundler-apps
Author Cloudflare Worker Bundler-compatible apps that build and preview correctly inside a space. Use this skill whenever you scaffold, modify, or deploy a project that will be built with @cloudflare/worker-bundler (i.e. anything served from /space/:name/preview/:branch/). Covers wrangler config, project layout…