Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nobodyohm-web/thot/boxnpx skills add nobodyohm-web/Thot --skill boxgit clone --depth 1 https://github.com/nobodyohm-web/ThotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nobodyohm-web/thot/box)<a href="https://agentmods.dev/skills/nobodyohm-web/thot/box"><img src="https://agentmods.dev/badge/skills/nobodyohm-web/thot/box.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00014 | $0.02440 |
| Opus 5 | $0.00007 | $0.01220 |
| Sonnet 5 | $0.00003 | $0.00488 |
| Haiku 4.5 | $0.00001 | $0.00244 |
Grade A, and why
box scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to box — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Box
Use Box as the cloud file system for file operations, collaboration, metadata, and document work. Run operations with Hermes' terminal tool and use the Box CLI; use the SDK guide when building an application.
When to Use
- Organizing, uploading, versioning, moving, sharing, or collaborating on Box files and folders
- Searching Box content or existing metadata
- Asking questions about Box files, extracting metadata, or generating text grounded in a file
- Processing a Box folder at scale without downloading every source file
- Building a Box-backed application, integration, or webhook handler
Start broad file-system conversations
When someone is exploring a cloud file system for Hermes, first give a short fit assessment: Box is useful when a team needs cloud file storage, sharing, search, metadata, and document work. Then ask whether they want to connect a Box account with OAuth or build a Box-backed application or integration with an SDK.
OAuth makes Hermes act as the Box account authorized in the browser. That account's Box permissions determine what Hermes can access. To give Hermes narrower access, authorize an account that is invited only to the required files, folders, or Hubs.
Do not run setup, show a command cookbook, propose account plans or folder taxonomies, or load every reference for a broad exploratory question. Wait for the user's answer, then load only the relevant path. When a request already names a concrete outcome, skip this discovery step and handle that outcome directly.
Start normal CLI work with the official Box CLI OAuth app. It covers ordinary content work and Box AI. Use a custom User Authentication (OAuth 2.0) Platform App only when the requested operation needs an additional OAuth scope, such as webhook management. This remains an OAuth flow; do not substitute a server-side or impersonation identity.
Perform chosen setup interactively
When a user selects an authentication path or asks Hermes to connect Box, perform the setup through terminal; do not turn the next response into instructions for the user to copy. Take the next safe action yourself, and pause only for an approval, browser sign-in, administrator action, or secret that Hermes cannot safely supply.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/bulk-operations.md 2.0 KB
- references/cli-guide.md 7.3 KB
- references/content-workflows.md 4.7 KB
- references/hubs.md 6.0 KB
- references/oauth-setup.md 6.4 KB
- references/rest-api.md 2.2 KB
- references/sdk-development.md 5.6 KB
- references/search-and-ai.md 10 KB
- references/troubleshooting.md 2.9 KB
- references/webhooks-and-events.md 2.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 118 lines · 14 tokens per session scan A e9672412333d
box is a skill published in the GitHub repository nobodyohm-web/Thot (0 stars, last pushed 10d ago), licensed MIT. It adds 14 tokens to every session and 2,440 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to box, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
google-workspace
Gmail, Calendar, Drive, Docs, Sheets via gws CLI or Python.
box
Box manages cloud files, sharing, search, and metadata.
ima-skill
统一的 IMA OpenAPI 技能，支持笔记管理和知识库操作。 当用户提到知识库、资料库、笔记、备忘录、记事，或者想要上传文件、添加网页到知识库、 搜索知识库内容、搜索/浏览/创建/编辑笔记时，使用此 skill。 即使用户没有明确说"知识库"或"笔记"，只要意图涉及文件上传到知识库、网页收藏、 知识搜索、个人文档存取（如"帮我记一下"、"搜一下知识库里有没有XX"），也应触发此 skill。.
notes
Skill "notes" from UnicomAI/wanwu, covering notes (笔记), 接口决策表, ⚠️ 新建 vs. 追加 — 行为规则, 明确走新建的信号词 and 明确走追加的信号词.
archive-protocol
全局归档协议。只要任务需要写入任何文件（含 PLAN.md、报告、JSON 等归档物），必须按本技能执行 Session→ARCHIVEID、TIMESTAMP、双轨路径（根段须为 archives/）、回读校验与状态回执；WebUI 的 archivegrid 必须用 Markdown 中语言标识为 json 的围栏代码块输出。.
apple-notes
Manage Apple Notes via the memo CLI on macOS (create, view, search, edit).