Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nowork-studio/notfair-plugin/setup-cmsnpx skills add nowork-studio/notfair-plugin --skill setup-cmsgit clone --depth 1 https://github.com/nowork-studio/notfair-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00111 | $0.02325 |
| Opus 5 | $0.00056 | $0.01162 |
| Sonnet 5 | $0.00022 | $0.00465 |
| Haiku 4.5 | $0.00011 | $0.00232 |
Grade A, and why
setup-cms scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 294 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/setup-cms
Guide the user through connecting their CMS to notfair's SEO analysis tools.
Once configured, /seo-analysis automatically pulls published content from
the CMS and cross-references it against Google Search Console data — finding
invisible pages, content gaps, stale articles, and missing SEO fields.
Step 0 — Setup
Read and follow ../shared/preamble.md — it locates the SEO scripts directory. Use $SKILL_SCRIPTS from the preamble for all script calls below.
Step 1 — Detect existing CMS configuration
CMS_TYPE=$(python3 "$SKILL_SCRIPTS/cms_detect.py" 2>/dev/null)
CMS_STATUS=$?
echo "CMS_TYPE=$CMS_TYPE EXIT=$CMS_STATUS"
-
CMS_STATUS=0→ a CMS is already configured ($CMS_TYPEis the name). Show the user: "You already have [$CMS_TYPE] connected. Would you like to reconfigure it, or switch to a different CMS?" Wait for their reply. If they say reconfigure/switch, continue to Step 2. If they say test or verify, jump to Step 5 (skip to connection test). -
CMS_STATUS=2→ nothing configured yet. Continue to Step 2.
Step 2 — Choose a CMS
Ask the user:
"Which CMS are you connecting? I support:
- WordPress — self-hosted or WordPress.com (uses REST API + Application Password)
- Strapi — v4 or v5, self-hosted (uses API Token)
- Contentful — cloud headless CMS (uses Delivery API key)
- Ghost — Ghost.org or self-hosted (uses Content API key)
Reply with the name or number."
Wait for their answer. Map to: wordpress, strapi, contentful, ghost.
Step 3 — Credential setup by CMS
Jump to the sub-section for the chosen CMS.
3A — WordPress
WordPress uses the built-in Application Passwords feature (introduced in WP 5.6). This is the safest way to grant API access — it never exposes your main password and can be revoked at any time.
Tell the user:
"I need three things to connect WordPress:
- Your WordPress URL (e.g.
https://myblog.com)- Your WordPress username (the one you log in with)
- An Application Password — create one in: WordPress Admin → Users → Profile → scroll to Application Passwords → enter a name like "notfair" → click Add New → copy the generated password
Paste each value when ready."
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 294 lines · 111 tokens per session scan A 4ba0b9edbfc0
setup-cms is a skill published in the GitHub repository nowork-studio/notfair-plugin (3,447 stars, last pushed 4d ago), licensed MIT. It adds 111 tokens to every session and 2,325 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
geo-platform-optimizer
Platform-specific AI search optimization — audit and optimize for Google AI Overviews, ChatGPT, Perplexity, Gemini, and Bing Copilot individually.
geo-schema
Schema.org structured data audit and generation optimized for AI discoverability — detect, validate, and generate JSON-LD markup.
subject-line-lab
Use when the user asks to "generate subject line variants", "pre-score my subject lines", or "will this subject get truncated / trigger spam filters"; produces a labeled subject + preheader variant set and a per-variant heuristic pre-score card — spam-trigger flags, length/truncation across desktop + mobile…
fit-scorer
Use when the user asks to "score this influencer", "rank these creators for our campaign", or "tell me which influencer is the best fit"; produces the typed STAR Suitability (S) read plus a separately labeled campaign-fit ranking without mixing campaign-specific commercial fit into the Suitability read. Not for…
influencer-discovery
Use when the user asks to "find influencers", "build an influencer list", or "discover creators in [niche]"; produces a multi-platform candidate pool, per-influencer evidence profiles, authenticity red-flag screening, and a Fit-readiness queue without action ranking. Not for STAR scoring or ranking a known shortlist …
fatigue-frequency-manager
Use when the user asks to "is my ad fatiguing", "why is CTR dropping at scale", or "should I rotate creative / widen the audience"; reads frequency, CTR and CVR decay against an early-flight baseline and returns Rotate-creative / Widen-audience / Hold triggers with a per-ad-set fatigue read. Not for building the…