Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/novoads/agent-skillsnpx agentmods add skills/novoads/agent-skills/clone-image-adWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/novoads/agent-skills/clone-image-ad)<a href="https://agentmods.dev/skills/novoads/agent-skills/clone-image-ad"><img src="https://agentmods.dev/badge/skills/novoads/agent-skills/clone-image-ad.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 311 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 345 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Agent Snooping · line 483 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00246 | $0.07361 |
| Opus 5 | $0.00123 | $0.03681 |
| Sonnet 5 | $0.00049 | $0.01472 |
| Haiku 4.5 | $0.00025 | $0.00736 |
Grade A, and why
clone-image-ad scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 493 lines — stays where its author put it; the contents beside it link to each section on GitHub.
clone-image-ad
Take an existing image ad and turn it into a reusable, parameterizable prompt template that gets appended to the shared 40-template image-ad library. The template is validated by round-tripping it through a Novoads image model and comparing against the original.
If the shared/ files are not on disk
Then this skill was installed on its own from skills.sh, and the library it is supposed to append
to came with nothing. Fetch each missing file from
https://raw.githubusercontent.com/novoads/agent-skills/main/<path>, where <path> is one of
shared/skills/clone-image-ad/prompting/guide.md,
shared/skills/image-ad-prompting/prompting/template-format.md,
shared/skills/image-ad-prompting/prompting/prompt-library.md and
shared/skills/image-ad-prompting/OVERVIEW.md. Cloning the whole pack with
git clone https://github.com/novoads/agent-skills.git is the better move here, because the
deliverable is an entry written back into prompt-library.md and a raw fetch gives you nowhere to
save it. That install has no scripts/check-novoads-env.sh either, so set NOVOADS_API_KEY in the
environment yourself and let the first call report the key.
Read order
Paths below are from the repo root. This skill is copied into .claude/skills/ and
.cursor/skills/ by sync-skill.sh, so a relative link out of it would break in those copies.
- This file — model choice, the validator, what's fixed at the repo layer.
shared/skills/clone-image-ad/prompting/guide.md— the full 10-phase workflow (visual analysis → draft prompt → generate-with-reference → iterate → generalize → test → cross-model validate → document → save).shared/skills/image-ad-prompting/prompting/template-format.md— entry skeleton.shared/skills/image-ad-prompting/prompting/prompt-library.md— destination for the new entry. 40 validated templates already there; new entries go at T40+.shared/skills/image-ad-prompting/OVERVIEW.md— ecosystem context.
Hard rules
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 493 lines · 246 tokens per session scan A 99faab26bbbb
clone-image-ad is a skill published in the GitHub repository novoads/agent-skills (14 stars, last pushed 12d ago), licensed MIT. It adds 246 tokens to every session and 7,361 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
xiaohongshu-auto-posting
Automates the complete Xiaohongshu (XHS / Little Red Book) content operation workflow: pain-point topic collection → style case collection → topic selection → content writing → publishing → performance tracking. Use when user mentions xiaohongshu auto posting, xhs auto post, little red book posting, xiaohongshu post…
muapi-seedance-2
Expert Cinema Director skill for Seedance 2.0 (ByteDance) — high-fidelity video generation across Chinese, Global, and VIP tiers. Supports text-to-video, image-to-video, first-last-frame, omni reference, character training, omni-reference training, video editing, and watermark removal.
video-shotcraft
Create cinematic product videos from shot recipe cards, a validated template, and code/audio assets (Remotion + real page screenshots + 2.5D camera moves + beat-synced cuts + sound design). Use when the user asks to turn a frontend project or webpage into a product video, says "use video-shotcraft to make a…
muapi-social-media-video
Brand-aware social media video creator. Reads brand-identity.md, ICP.md, and messaging.md to write a post/storyboard, craft an optimized Seedance 2.0 Director prompt, generate reference frames with the best available image model, and produce platform-ready video.
muapi-ai-clipping
Turn a long video into N viral-ready short clips with a single managed API call. Wraps muapi.ai's /ai-clipping endpoint, which handles transcription, highlight ranking through a virality framework (hook / emotional peak / opinion bomb / revelation / conflict / quotable / story peak / practical value), overlap dedupe…
muapi-youtube-shorts
Auto-generate viral 9:16 YouTube Shorts (or TikTok / Reels clips) from a long-form video. Thin platform-aware wrapper around the AI Clipping skill — picks sensible defaults for short-form social platforms (9:16, 30–60s sweet spot) and delegates the actual highlight extraction + crop to muapi.ai's /ai-clipping endpoint.