Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/normalled/apijack/test-tutorial-agentnpx skills add normalled/apijack --skill test-tutorial-agentgit clone --depth 1 https://github.com/normalled/apijackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.00561 |
| Opus 5 | $0.00024 | $0.00280 |
| Sonnet 5 | $0.00010 | $0.00112 |
| Haiku 4.5 | $0.00005 | $0.00056 |
Grade C, and why
test-tutorial-agent scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /home/garret/projects/apijack/.apijack Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
until curl -sf http://localhost:3456/v3/api-docs > /dev/null 2>&1; do sleep 0.2; done The source is not reproduced here
No licence file
A repository with no LICENSE is all rights reserved by default, so the body is not copied here. The metadata, the measurements and the link are.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 62 lines · 48 tokens per session scan C 60b3024b1401
test-tutorial-agent is a skill published in the GitHub repository normalled/apijack (7 stars, last pushed 7d ago), with no licence file. It adds 48 tokens to every session and 561 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
create-tutorial
Scaffold a new Membrane API Gateway tutorial in the api-gateway repo — the numbered self-teaching YAML under distribution/tutorials/ /, its support files and README links, and the matching auto-discovered integration test. Use whenever the user asks to create, add, write, or scaffold a tutorial (or a tutorial step)…
run-example-test
Run a single distribution example or tutorial integration test (IT) fast, instead of the whole 6 min example suite. Use when asked to run, verify, or check one example/tutorial test in the api-gateway distribution module.
docs-page
三栏文档页: 侧导航 + 正文 + 右 TOC.
find-example
Find the runnable examples and tutorials that demonstrate a Membrane interceptor or config element, given its XML name (the @MCElement value), e.g. "is there an example for ?", "which tutorials use the rewriter?", "show me examples of apiKey". Use whenever the user wants to locate existing examples or tutorials under…
empirica-constitution
Empirica deep governance — phase-aware completion, the cognitive immune system, the turtle principle, and the practice model. Load this when the system prompt's operational routing isn't enough — when you need the why underneath the mechanism choice, or when "what counts as done" / "what is this practice" is the…
fireworks-training
Train and fine-tune models on Fireworks from a coding agent. Covers managed SFT, DPO, ORPO, and RFT through firectl; Training API serverless and dedicated workflows; cookbook recipes and custom Python loops; dataset preparation and evaluators; model and shape choice; complete parameter and cost confirmation…