Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MoizIbnYousaf/marketing-cli --skill video-reportgit clone --depth 1 https://github.com/MoizIbnYousaf/marketing-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/moizibnyousaf/marketing-cli/video-report)<a href="https://agentmods.dev/skills/moizibnyousaf/marketing-cli/video-report"><img src="https://agentmods.dev/badge/skills/moizibnyousaf/marketing-cli/video-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/moizibnyousaf/marketing-cli/video-report"><img src="https://agentmods.dev/badge/skills/moizibnyousaf/marketing-cli/video-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00009 | $0.00071 |
| Opus 5.5 | $0.00004 | $0.00028 |
| Sonnet 5.5 | $0.00002 | $0.00014 |
| Haiku 4.5 | $0.00001 | $0.00007 |
Grade A, and why
video-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
When a user reports a video not working, we should download the URL and put it as the src in packages/example/src/NewVideo.tsx.
Then, in packages/example, we should run bunx remotion render NewVideo --log=verbose.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 9 lines · 9 tokens per session scan A 072d54efab4b
video-report is a skill published in the GitHub repository MoizIbnYousaf/marketing-cli (32 stars, last pushed 10d ago), licensed MIT. It adds 9 tokens to every session and 71 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
debug-extension
Diagnose and fix failures in a built third-party .ppmplugin control: crashes, silent no-ops, PCF error outputs, or incorrect behavior. Uses the reported symptom, shared/error-codes.md, and file-level evidence to trace the manifest, Android/iOS modules, PCF dispatch, and build configuration. Produces a ranked…
audit-ppmplugin
Statically audit a built .ppmplugin before wrap testing. Checks archive layout, manifest compatibility, bundle consistency, Android DEX integrity and SDK leakage, iOS framework structure, native source-to-receiver alignment, and the PCF composite-key/sendAsync transport contract. Reports CRITICAL, WARNING, and INFO…
generate-ppmplugin-manifest
Validate, reconcile to the chosen target(s), and stage the manifest.json for a .ppmplugin bundle. In the normal flow the committed ./manifest.json already exists (authored by /generate-native-extension), so this stage reads it, runs the plugin's upload-compatibility checks locally as a pre-flight gate (name regex…
principle-attack-the-premise
Apply when two or more fixes that share one premise have failed the same gate. Write the premise down and test it directly before you write another fix that assumes it.
principle-fix-root-causes
Apply when debugging. Trace each symptom back to the first place the system went wrong and fix it there. A guard is a fix only when the state it handles is legitimate.
performance-smell-detection
Detect potential code-level performance smells in Java - streams, collections, boxing, regex, object creation. Provides awareness, not absolutes - always measure before optimizing. For JPA/database performance, use jpa-patterns instead.