Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NoesisVision/nasde-toolkit --skill nasde-benchmark-runnergit clone --depth 1 https://github.com/NoesisVision/nasde-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/noesisvision/nasde-toolkit/nasde-benchmark-runner)<a href="https://agentmods.dev/skills/noesisvision/nasde-toolkit/nasde-benchmark-runner"><img src="https://agentmods.dev/badge/skills/noesisvision/nasde-toolkit/nasde-benchmark-runner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/noesisvision/nasde-toolkit/nasde-benchmark-runner"><img src="https://agentmods.dev/badge/skills/noesisvision/nasde-toolkit/nasde-benchmark-runner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 49 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 50 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 51 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Excessive Agency · line 191 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 195 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 250 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- high Excessive Agency · line 260 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- medium analysis-evasion · line 1 Suspicious Unicode normalization or mixed-script contentFix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- medium MCP Rug Pull · line 471 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00139 | $0.07791 |
| Opus 5.5 | $0.00056 | $0.03116 |
| Sonnet 5.5 | $0.00028 | $0.01558 |
| Haiku 4.5 | $0.00014 | $0.00779 |
Grade A, and why
nasde-benchmark-runner scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Use Python `urllib.request` (never curl — it drops the `Comet-Workspace` header): How it starts
The opening of the file, as written. The whole thing — 522 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NASDE Benchmark Runner
Run coding agent benchmarks with nasde and verify results. The two-stage pipeline: Harbor runs agents in Docker containers (functional test → reward 0/1), then an LLM-as-a-Judge scores architecture quality across multiple dimensions.
Authentication setup
Before running any benchmark, set up authentication tokens for the agents you plan to run. Both OS and auth method matter — pick the right command per row.
Step 1 — Ask the user which auth they prefer
Always ask the user before running, never assume. Two questions:
- Which agents will you run? (Claude / Codex / Gemini, any combination)
- For each agent, OAuth (subscription) or API key (per-token billing)? Default recommendation: OAuth where available — no per-token cost, no env vars to manage.
Then detect their OS and pick the matching script row from the table below. On Windows, also ask whether they're in PowerShell or WSL (cmd.exe is not directly supported — see "Windows: cmd.exe" below).
Where the auth scripts live
The OAuth scripts ship inside this skill. After nasde install-skills they are at:
- User scope (default):
~/.claude/skills/nasde-benchmark-runner/scripts/(macOS/Linux/WSL) or%USERPROFILE%\.claude\skills\nasde-benchmark-runner\scripts\(Windows PowerShell) - Project scope:
<project>/.claude/skills/nasde-benchmark-runner/scripts/(if installed withnasde install-skills --scope project) - Editable nasde checkout (devs only):
<repo>/scripts/— same files, mirrored from the skill bundle
Below, <SKILL_SCRIPTS> is shorthand for whichever absolute path applies. Resolve it once, then substitute it in every command. Verify the path with ls <SKILL_SCRIPTS> before telling the user to source anything — if the directory is missing, they need to run nasde install-skills first.
Step 2 — Run the right script per agent × OS
Priority order: Claude → Codex → Gemini. Claude is required even for non-Claude variants when [evaluation] backend = "claude" (default), because the assessment evaluator spawns claude CLI as a subprocess.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/export_codex_oauth_token.ps1 2.2 KB runs code
- scripts/export_codex_oauth_token.sh 2.3 KB runs code
- scripts/export_gemini_oauth_token.ps1 2.0 KB runs code
- scripts/export_gemini_oauth_token.sh 2.1 KB runs code
- scripts/export_oauth_token.ps1 1.3 KB runs code
- scripts/export_oauth_token.sh 1.7 KB runs code
- scripts/pareto.py 21 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines 7df699e0065e
- 1mo ago First seen · 521 lines · 139 tokens per session scan A d104b674e93f
nasde-benchmark-runner is a skill published in the GitHub repository NoesisVision/nasde-toolkit (14 stars, last pushed 6d ago), licensed MIT. It adds 139 tokens to every session and 7,791 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
generate-tests
Generate EvalView test cases — either from a SKILL.md file using LLM-powered generation, or by capturing real agent interactions through a proxy.
run-eval
Run EvalView regression checks against golden baselines to detect regressions in AI agent behavior after code, prompt, or model changes.
watch
Start EvalView watch mode to automatically re-run regression checks whenever project files change.
uig
Build a User Input Grid (UIG) for an AI product or feature, evaluate existing eval datasets against it, and propose new inputs to fill coverage gaps. Use this skill whenever someone asks to design an eval framework, audit a test set, build a "user input grid", "synthetic query matrix" or "SQM", improve dataset…
eval-llm-judge
Write LLM-as-judge evaluator prompts for AI products. Use this skill whenever you need to evaluate semantic properties of AI outputs that cannot be checked programmatically — output quality, tone, factual accuracy, edge case handling, reference alignment. Also use when auditing existing judge prompts for bias…
eval-code
Write deterministic, code-based evaluator functions for an AI product. Use this skill whenever you need to write evaluators that check structural properties of AI outputs (format, count, presence, schema compliance) without calling another LLM. Also use when auditing existing code-based evaluators for brittleness…