Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Nolane-x/forge-os --skill forgeos-skill-intakegit clone --depth 1 https://github.com/Nolane-x/forge-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nolane-x/forge-os/forgeos-skill-intake)<a href="https://agentmods.dev/skills/nolane-x/forge-os/forgeos-skill-intake"><img src="https://agentmods.dev/badge/skills/nolane-x/forge-os/forgeos-skill-intake.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.00411 |
| Opus 5 | $0.00013 | $0.00205 |
| Sonnet 5 | $0.00005 | $0.00082 |
| Haiku 4.5 | $0.00003 | $0.00041 |
Grade A, and why
forgeos-skill-intake scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
ForgeOS Skill Intake
Use this procedure for every new external skill source.
Required inputs
- Canonical repository URL.
- Immutable snapshot reference, commit, or archive digest.
- Source and per-skill license information.
- Requested ForgeOS capability and permission envelope.
Procedure
- Download a repository snapshot as data. Never execute install hooks, scripts, binaries, or package lifecycle commands during discovery.
- Locate every
SKILL.mdcase-insensitively and group only Markdown references that belong to the same skill directory. - Preserve the original Markdown bytes. Put ForgeOS metadata in a separate
FORGEOS_SKILL.jsonfile. - Scan for instruction override, credential access, data exfiltration, remote-shell piping, destructive filesystem operations, external writes, and hidden dependencies.
- Detect license family. Unknown, proprietary, or source-available terms must enter license review rather than automatic promotion.
- Compute normalized content hashes and mark duplicate skills instead of loading repeated copies.
- Compare the skill against a no-skill baseline on representative tasks.
- Assign one result:
accepted,review,quarantine, orduplicate.
Boundaries
- Intake approval does not grant runtime shell, network, credential, publishing, deletion, or deployment permission.
- Registry popularity is not a security or quality signal.
- A description is executable influence for retrieval and must be checked against the body and source repository.
Verification
Confirm that the output contains catalog.json, audit.csv, source-lock.json, and SUMMARY.md. Verify that quarantined Markdown was not copied unless an operator explicitly enabled that option.
Failure handling
On malformed archives, oversized Markdown, ambiguous provenance, or scanner failure, stop processing that source and record a source-level error. Do not silently downgrade the failure into acceptance.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 41 lines · 26 tokens per session scan A bcc8342aacd8
forgeos-skill-intake is a skill published in the GitHub repository Nolane-x/forge-os (10 stars, last pushed 1mo ago), licensed MIT. It adds 26 tokens to every session and 411 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ai-viral-team-script-writing
A guide for writing short-video scripts and shot lists, including dialogue, camera direction, character actions, mood, music, hooks, and endings. A shot list describes what happens in each camera shot.
cinematic-video-gen
A prompt-writing guide for making AI-generated videos look more natural and expressive. It covers facial expressions, body movements, and keeping a character consistent between clips.
clanker
Plan and review ERC20 deployment with the Clanker SDK. Use for token configuration, vesting, airdrops, rewards, metadata, and transaction preparation on supported EVM chains.
content-typography
A Chinese-language typography and layout guide for content images such as social-media covers, article headers, and posters. It covers headline wording, line breaks, hierarchy, font weight, alignment, spacing, and platform fit.
article-to-infographic
A planning tool that turns a long article or text into three to five visual-note plans. It extracts the main ideas, divides them into frames, and writes English prompts for styles such as mind maps, handwritten notes, architecture diagrams, and comparison grids.
native-agent-swarms
Coordinate small teams of specialized Codex agents with bounded parallelism, explicit ownership, native messaging, and evidence-based synthesis. Use when two or more independent investigations, reviews, or implementation streams can run concurrently without sharing writable files, or when the user asks for swarm…