Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nimadorostkar/Claude-Skills-collection --skill cli-developmentgit clone --depth 1 https://github.com/nimadorostkar/Claude-Skills-collectionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/cli-development)<a href="https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/cli-development"><img src="https://agentmods.dev/badge/skills/nimadorostkar/claude-skills-collection/cli-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/cli-development"><img src="https://agentmods.dev/badge/skills/nimadorostkar/claude-skills-collection/cli-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.01003 |
| Opus 5 | $0.00017 | $0.00502 |
| Sonnet 5 | $0.00007 | $0.00201 |
| Haiku 4.5 | $0.00003 | $0.00100 |
Grade A, and why
cli-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLI Development
Purpose
Build command-line tools that behave the way the shell expects: composable, scriptable, quiet by default, and honest about failure.
When to Use
- Building a developer tool, deployment script, or internal utility with a CLI.
- Designing the argument surface of an existing tool.
- Making a tool safe to use inside pipelines and CI.
Capabilities
- Argument and subcommand design.
- Correct use of stdout, stderr, and exit codes.
- Configuration precedence: flags, environment, config file, defaults.
- Human output versus machine output (
--json, TTY detection). - Progress, colour, and interactivity that degrade correctly when piped.
Inputs
- The tasks the tool must perform and who runs it (humans, CI, both).
- Whether it will be composed with other tools.
- Whether it performs destructive operations.
Outputs
- A command surface that is predictable and discoverable.
- Machine-readable output behind a flag.
- Exit codes that scripts can branch on.
- Help text that answers the question without a web search.
Workflow
- Design the verbs — Subcommands are verbs on nouns:
tool deploy service, nottool --deploy --service. Group related operations. - Separate the streams — Results go to stdout. Everything else — progress, warnings, logs — goes to stderr. This is what makes
tool list | grep xwork. - Define the exit codes — 0 for success, 1 for a general failure, 2 for a usage error. Document any others.
- Set the configuration precedence — Command-line flag beats environment variable beats config file beats default. Never surprise the user by reversing this.
- Detect the TTY — Colour, spinners, and prompts only when stdout is a terminal. When piped, output is plain and non-interactive.
- Make destruction opt-in — Anything irreversible requires confirmation, or
--yeswhen non-interactive.--dry-runon anything with side effects.
Best Practices
- Be quiet on success. A tool that prints five lines of celebration on every run is unusable in a loop.
- Provide
--jsonfor anything a script might parse. Parsing human output is a bug generator for everyone downstream. - Honour
NO_COLORand--no-color. HonourCIby disabling interactivity. - Long flags are self-documenting; short flags are for the ones typed constantly. Do not invent a short flag for every option.
- Read from stdin when the input argument is
-. It costs three lines and makes the tool composable. - Error messages state what failed, why, and what to do about it. "Error: invalid input" is not one of those.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 103 lines · 34 tokens per session scan A 867dd381c5b2
cli-development is a skill published in the GitHub repository nimadorostkar/Claude-Skills-collection (26 stars, last pushed 22d ago), licensed MIT. It adds 34 tokens to every session and 1,003 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
offensive-api-abuse
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query…
offensive-graphql
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested…
agent-ready-auth-md
Sub-skill: Implement Auth.md for agent registration discovery. Serve /auth.md with OAuth metadata at /.well-known/oauth-protected-resource and authorization server endpoints.
agent-ready-dns-aid
Sub-skill: Implement DNS-AID records so agents discover endpoints through DNS. Use SVCB/HTTPS records under agents namespace with alpn and connection parameters.
agent-ready-link-headers
Sub-skill de agent-ready-cloudflare: Implement Link Response Headers.
agent-ready-markdown-negotiation
Sub-skill de agent-ready-cloudflare: Implement Markdown Content Negotiation.