Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mislavjc/stoop --skill stoop-apigit clone --depth 1 https://github.com/mislavjc/stoopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mislavjc/stoop/stoop-api)<a href="https://agentmods.dev/skills/mislavjc/stoop/stoop-api"><img src="https://agentmods.dev/badge/skills/mislavjc/stoop/stoop-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mislavjc/stoop/stoop-api"><img src="https://agentmods.dev/badge/skills/mislavjc/stoop/stoop-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.02665 |
| Opus 5.5 | $0.00033 | $0.01066 |
| Sonnet 5.5 | $0.00016 | $0.00533 |
| Haiku 4.5 | $0.00008 | $0.00266 |
Grade A, and why
stoop-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST https://stoop.run/api/sites \ How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publishing a stoop site over HTTP
One authenticated POST publishes a static site and returns its URL. No browser session, no zip, no filesystem, no terminal — for code that needs to put a page on the web while it runs.
Writing any platform.* call? Load the stoop-platform skill first — it
is the full SDK surface, and guessing at this API produces a page that looks
right and silently loses data.
First: should this be a page at all?
| surface | fits | example |
|---|---|---|
| a short reply | a sentence, a number, a yes or no | "all three deploys are green" |
| a long document | prose read top to bottom, or edited afterwards | a postmortem, a spec |
| a page | anything whose layout carries meaning | a dashboard, a sortable table, a chart, a comparison grid |
The test is whether the layout carries meaning. Publish because reading the thing as text would lose something — not because the answer felt important. A paragraph you are proud of is still a paragraph; send it as a reply.
The call
curl -X POST https://stoop.run/api/sites \
-H "authorization: Bearer $STOOP_API_KEY" \
-H "content-type: application/json" \
-d '{"name":"deploy-health","files":{"index.html":"<h1>hi</h1>"}}'
The response carries the site url, and findings (read them — see
below). Limits: 50 files, 25 MB total.
The key
The user mints it once with npx @stoop/cli keys create <name>, and it is
shown only at creation. Ask them to run it — like login, it needs
their account, so do not run it yourself. Read the secret from the
environment; never hold it in source.
A key writes only inside its own namespace: a key named release-bot
reaches release-bot-* and nothing else, so the call above lands at
release-bot-deploy-health.stoop.run.
Never start the name with your key's prefix
The namespace is added for you. So do not send release-bot-deploy-health
even when the human says "call it release-bot-deploy-health" — you would be
asking for release-bot-release-bot-deploy-health. The server strips one
redundant prefix, so this is no longer a broken URL, but it is still the
difference between the name you meant and one you did not.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 260 lines · 82 tokens per session scan A 55738e992ba3
stoop-api is a skill published in the GitHub repository mislavjc/stoop (1 stars, last pushed 2mo ago), licensed MIT. It adds 82 tokens to every session and 2,665 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
munkel
Send ephemeral end-to-end-encrypted messages that appear in friends' MacBook notches, via the munkel CLI (macOS). Use when the user wants to message, ping, or notify someone in a Munkel channel, broadcast to a channel, or list Munkel channels and members.
hono-cloudflare
Hono on Cloudflare Workers - bindings, KV, D1, R2, Durable Objects, and edge deployment patterns.
integrate-unprice-sdk
Integrate and troubleshoot the @unprice/api TypeScript SDK in server-side Node.js, Next.js, Hono, or edge applications. Use when onboarding Unprice customers, checking access, enforcing or recording usage, reserving budgets for multi-step workloads, handling Unprice API results, reviewing an existing Unprice…
sharehtml-collaboration
Use when a user wants to deploy, update, diff, pull, or review feedback on documents managed with the sharehtml CLI. This skill covers safe deploy workflows, reviewing unresolved comments, finding documents by name with sharehtml list, and presenting diffs in human language before overwriting. Keep documents private…
cf-integrations-reference
The consolidated, world-class Cloudflare + integrations reference — CF platform/data/AI-edge patterns, media pipeline, observability/growth, payments, and the site-generation pipeline. The non-inferable choices that build the greatest web apps.
auth-setup
Auth worker setup for Better Auth, OAuth, admin bootstrap, and env/secrets. Use when configuring auth for a fork, setting redirect URIs, or debugging auth env.