Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/modu-ai/moai-coworknpx agentmods add skills/modu-ai/moai-cowork/doc-html-reportWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/modu-ai/moai-cowork/doc-html-report)<a href="https://agentmods.dev/skills/modu-ai/moai-cowork/doc-html-report"><img src="https://agentmods.dev/badge/skills/modu-ai/moai-cowork/doc-html-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/modu-ai/moai-cowork/doc-html-report"><img src="https://agentmods.dev/badge/skills/modu-ai/moai-cowork/doc-html-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 40 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 141 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00216 | $0.04822 |
| Opus 5.5 | $0.00086 | $0.01929 |
| Sonnet 5.5 | $0.00043 | $0.00964 |
| Haiku 4.5 | $0.00022 | $0.00482 |
Grade A, and why
doc-html-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
doc-html-report: 단일 파일 HTML 보고서 렌더러
목적과 범위
moai-officer:doc-html-report는 보고서용 HTML 서식과 작성 절차를 제공합니다.
moai-coworker:collab-exec-summary, moai-accountant:finance-financial-statements, moai-consultant:consult-sbiz365 등이 생성한 마크다운 보고서를 참고해 단일 HTML 파일을 작성합니다. 이 스킬에는 자동 변환 실행기가 포함되어 있지 않습니다.
핵심 원칙:
- 외부 JS 라이브러리(Chart.js, D3, htmx) 0 의존
- 외부 CSS 프레임워크(Tailwind, Bootstrap) 0 의존
- 인라인 SVG로 차트 직접 렌더링
- 한국어 폰트 CDN은 선택 사항으로 두고, 연결되지 않을 때 시스템 서체로 읽을 수 있게 한다
이 스킬은 마크다운 출력을 대체하지 않습니다. 마크다운은 단일 진실(source of truth)로 유지되며, HTML 렌더링은 추가 분기로만 작동합니다.
입력
| 인자 | 필수 | 기본값 | 설명 |
|---|---|---|---|
markdown |
✓ | — | 변환할 마크다운 본문 |
mode |
✓ | — | status | incident | plan | explainer | financial | pr |
design_system |
— | 기본 템플릿 | moai-designer:design-system-library에서 현재 확인한 브랜드 시스템. 외부 CDN을 쓰는 구현은 인터넷 연결 필요 |
slug |
— | 제목에서 정함 | 출력 파일명 prefix |
output_path |
— | <cwd>/reports/<slug>-<YYYYMMDD>.html |
출력 경로 |
font_stack |
— | 모드별 기본값 | 폰트 매핑 오버라이드 |
템플릿의 {{변수}}는 작성용 슬롯 표기다. 렌더러가 제공되지 않으므로 슬롯을 채운 뒤 {{...}} 잔류 여부를 확인한다. 사용자가 제공한 문구는 HTML로 이스케이프하고, 링크는 허용한 https: URL인지 확인한다. *_html처럼 이름에 HTML이 있어도 일반 텍스트 슬롯이다. SVG·HTML 구조가 필요하면 검증된 데이터로 직접 작성하고 스크립트·이벤트 속성·외부 참조가 없는지 확인한다. 확인할 수 없으면 텍스트나 표로 표현한다.
차트와 지표는 원본에 있는 값만 사용한다. 시계열 중간값, 증감률, 원인 설명이 원본에 없으면 그려 넣지 않고 해당 칸을 비우거나 차트를 생략한다. 전체 보고서 변환 요청에서는 템플릿에 없는 원본 섹션도 별도 표·섹션으로 보존한다. 사용자가 요약본을 요청해 생략할 때만 빠진 범위를 산출물에 밝힌다. 저장된 references/samples/와 references/integration-tests/는 가상 서식 자료이며 새 문서의 사실 출처나 현재 호스트의 품질 판정으로 쓰지 않는다.
출력
단일 .html 파일 (<cwd>/reports/<slug>-<YYYYMMDD>.html):
- 크기: 본문과 포함된 이미지·스타일에 따라 달라짐
- 외부 의존성: 선택한 폰트·디자인 시스템에 따라 달라짐. 외부 리소스가 있다면 자체 완결형이라고 표시하지 않음
- 오프라인 사용: 파일을 네트워크 없이 열어 내용과 스타일을 확인한 경우에만 표시
6개 모드
제공하는 템플릿 모드
| 모드 | 구조 섹션 | 대상 스킬 |
|---|---|---|
status |
메트릭 카드 4개 · 하이라이트 · 완료 테이블 · Velocity SVG 막대 차트 · Carryover | moai-coworker:collab-exec-summary, moai-officer:productivity-briefing |
incident |
TL;DR 다크 배너 · 타임라인 · 로그 발췌 <details> · 코드 diff 패널 · 영향 테이블 · 액션 체크리스트 |
moai-lawyer:legal-compliance-check |
plan |
요약 KPI 스트립 · 마일스톤 수직 타임라인 · 데이터 플로우 SVG · 슬라이스 테이블 · 리스크 그리드 · 성공 지표 | moai-consultant:consult-sbiz365 |
explainer |
사이드 네비 · <details> 접이식 단계 · 탭 코드 블록(vanilla JS) · FAQ 아코디언 · 콜아웃 박스 |
설명형 문서 |
financial |
KPI 카드 4개 · 손익계산서 테이블(항목/당기/전기/증감/증감률) · Variance SVG 수평 막대 차트 · 주석 패널 | moai-accountant:finance-financial-statements |
pr |
TL;DR · PR 메타 행(파일수·+/−·브랜치) · Before/After 2단 카드 · 파일 투어 <details> · 핵심 포인트 · 테스트 체크리스트 · 롤아웃 단계 |
moai-accountant:finance-investor-relations |
What ships with it
23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/design-tokens.md 6.0 KB
- references/fonts.md 4.8 KB
- references/integration-tests/COMPATIBILITY.md 11 KB
- references/integration-tests/daily-briefing-input.md 3.2 KB
- references/integration-tests/daily-briefing-rendered.html 15 KB
- references/integration-tests/executive-summary-input.md 1.9 KB
- references/integration-tests/executive-summary-rendered.html 14 KB
- references/integration-tests/financial-statements-input.md 3.8 KB
- references/integration-tests/financial-statements-rendered.html 14 KB
- references/integration-tests/sbiz365-analyst-input.md 5.5 KB
- references/integration-tests/sbiz365-analyst-rendered.html 18 KB
- references/samples/explainer-sample.html 23 KB
- references/samples/financial-sample.html 13 KB
- references/samples/incident-sample.html 15 KB
- references/samples/plan-sample.html 22 KB
- references/samples/pr-sample.html 23 KB
- references/samples/status-sample.html 19 KB
- references/templates/explainer.html.tmpl 14 KB
- references/templates/financial.html.tmpl 14 KB
- references/templates/incident.html.tmpl 17 KB
- references/templates/plan.html.tmpl 16 KB
- references/templates/pr.html.tmpl 18 KB
- references/templates/status.html.tmpl 18 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · +1 lines d11d3868993f
- 29d ago Changed · -3 lines · -28 tokens per session afd803ca8731
- 1mo ago First seen · 286 lines · 244 tokens per session scan A 6c632523c5ea
doc-html-report is a skill published in the GitHub repository modu-ai/moai-cowork (311 stars, last pushed 16d ago), licensed Apache-2.0. It adds 216 tokens to every session and 4,822 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
baalda-guide
Answer any question about Baalda (the team second-brain app at baalda.com) in plain, non-technical language — what it is, what it can and cannot do, which file formats it supports (Markdown, images, PDF, DOCX, XLSX, code files), how sync, offline, sharing, permissions, version history, AI/MCP, pricing, platforms and…
report-formats
Output formats and report templates for the research-team plugin's reports. The research-report-writer agent loads this skill for every report. It also applies when a user asks for a research report, technical survey, decision brief, landscape scan, what's-new digest or source summary in a particular editor's format…
penalista-archivio
Conversione di documenti (PDF, sentenze, atti, dottrina) in Markdown indicizzato per la Knowledge Base, e governo dell'INDICE della giurisprudenza. ATTIVARE quando l'avvocato dice: 'converti questo PDF', 'metti questa sentenza in memoria', 'aggiungi alla knowledge base', 'indicizza i massimari', 'trasforma in…
wet
Dùng wet CLI để tải/đọc/nén tài liệu web & library docs (web scraping, library-docs, crawl4ai, searxng). Dùng khi cần fetch docs, warmup cache, doctor kiểm tra cấu hình — thay vì mở MCP server.
recipe-backup-sheet-as-csv
Export a Google Sheets spreadsheet as a CSV file for local backup or processing.
recipe-bulk-download-folder
List and download all files from a Google Drive folder.