Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ninemindai/agentgemnpx agentmods add skills/ninemindai/agentgem/agentgem-miniappWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ninemindai/agentgem/agentgem-miniapp)<a href="https://agentmods.dev/skills/ninemindai/agentgem/agentgem-miniapp"><img src="https://agentmods.dev/badge/skills/ninemindai/agentgem/agentgem-miniapp.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 109 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.02949 |
| Opus 5 | $0.00043 | $0.01474 |
| Sonnet 5 | $0.00017 | $0.00590 |
| Haiku 4.5 | $0.00009 | $0.00295 |
Grade A, and why
agentgem-miniapp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
agentgem-miniapp
Changing the miniapp platform, not authoring a miniapp? The normative spec is
docs/miniapps/spec.md— implement against its conformance checklist, and readdocs/miniapps/evolution.mdbefore re-deciding anything it records. If your change touches the authoring contract, editMINIAPP_BUILDER_BRIEFinpackages/play/src/builderBrief.ts— the body below is a byte-for-byte view of that constant (this file must end with it;src/play/__tests__/builderBrief.test.tsguards the mirror), and the Studio agent only ever sees the constant, so a SKILL.md-only edit changes nothing at runtime.
The file
You are editing one file: <name>.html — a single, self-contained HTML document. Never add a
second file. If the file has AGENTGEM:GAME-LOGIC start/end markers, keep your changes between
them.
It runs in a null-origin sandboxed iframe (sandbox="allow-scripts", no allow-same-origin)
under this Content-Security-Policy:
default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline';
img-src data:; font-src data:; media-src data:;
So inline every byte of JS and CSS, use only data: URIs for images, fonts and media, and make no
network calls of any kind.
Theming. The host may supply CSS variables — --color-background-primary,
--color-background-secondary, --color-text-primary, --color-border-primary — and sets theme
("light" or "dark") on <html data-theme> automatically. Read them with a fallback, because most
hosts send none: background: var(--color-background-primary, #0d1117). On app.agentgem.ai, and any
other host that sends no variables, the fallback is what renders.
What Save enforces
Two gates run when the user saves. Both throw a message you will see in the studio.
The seal. Rejects, anywhere in executable code:
- an external
src=orhref=(anything other thandata:or#) - a bare module import (
import … from "…") - the words
fetch,XMLHttpRequest,WebSocket,EventSource,importScripts,navigator.sendBeacon
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 205 lines · 85 tokens per session scan A 47d6d82c6863
agentgem-miniapp is a skill published in the GitHub repository ninemindai/agentgem (39 stars, last pushed 10d ago), licensed MIT. It adds 85 tokens to every session and 2,949 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vrchat-world-queries
VRChat world: new worlds, recommend, lore, X creators.
test-designing-guide
Provides test design methodology for Unity projects. Use this skill whenever designing test cases from requirements or specifications, including selecting test techniques, deriving test cases, and formatting them. Even for small features, load this skill to ensure test design rigor.
test-writing-guide
Provides guidelines for writing test code for Unity projects. Make sure to use this skill whenever writing, creating, editing, or modifying test code files (files under Tests/). This includes implementing new tests, fixing test failures, adding test cases, or any task that results in test code changes. Even for small…
algo-rank-trueskill
Implement TrueSkill rating system for multiplayer and team-based competitive ranking. Use this skill when the user needs to rate players in team games, handle multiplayer (non-1v1) matchups, or build a matchmaking system with uncertainty tracking — even if they say 'team rating system', 'multiplayer ranking', or…
edit-scene
Creates and modifies Unity scene and prefab files. Use this skill whenever creating, editing, or modifying .unity scene files or .prefab prefab files. This includes adding GameObjects, building uGUI hierarchies, wiring up components, and any task that results in changes to .unity or .prefab files.
run-tests
Provides guidelines for running Unity tests using the rununitytests tool. Make sure to use this skill whenever running, executing, or re-running tests on the Unity editor. This includes verifying implementations, debugging test failures, running specific test assemblies, or any task that involves the rununitytests…