Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add open-octo/octo-agent --skill genuigit clone --depth 1 https://github.com/open-octo/octo-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/open-octo/octo-agent/genui)<a href="https://agentmods.dev/skills/open-octo/octo-agent/genui"><img src="https://agentmods.dev/badge/skills/open-octo/octo-agent/genui/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/open-octo/octo-agent/genui"><img src="https://agentmods.dev/badge/skills/open-octo/octo-agent/genui.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 275 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.04175 |
| Opus 5 | $0.00049 | $0.02087 |
| Sonnet 5 | $0.00020 | $0.00835 |
| Haiku 4.5 | $0.00010 | $0.00417 |
Grade A, and why
genui scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 280 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GenUI
GenUI lets you describe a small UI tree as JSON — cards, stats, tables, lists, badges, progress bars, callouts, charts, diagrams, code blocks, and form controls — and have it render as real components in the chat instead of you writing the same information out as prose or a markdown table. There are two ways to emit a spec; which one to use depends on what you're building and where the reply is going. Read "The two output surfaces" before picking.
The two output surfaces
1. The render_ui tool. Call it with {"spec": {"title"?: string, "items": GenuiNode[]}}.
Read-only components only — no buttons, no inputs. The tool validates and
clamps your spec server-side and returns it on the same channel other
tools use for rich result cards, so it renders as a tool-result card in the
Web UI. This is the only surface available in every transport, but "every
transport" doesn't mean "the card is visible everywhere": IM and the TUI
never show tool-result cards at all — they show only your plain-text reply
for that turn. If you call render_ui in an IM or TUI conversation, follow
it with a plain-text reply that stands on its own; don't assume the user saw
the card.
2. An inline ```octo-ui fence in your reply text. Write a fenced code
block with the language tag octo-ui whose body is a GenUI spec (same shape
as render_ui's spec argument). This is the only surface that supports the
interactive node types (see below), and it renders as a live component tree
inline with the rest of your markdown — but only in a Web UI chat session.
IM and the TUI cannot render a component tree, so they replace the fence with
a plain placeholder line before the user ever sees it. There is no reliable
signal available to you, in the turn itself, telling you which transport
you're replying into — so decide whether to use an inline fence from ordinary
conversational context (has the user been interacting with a visual UI this
session? did they mention a phone/chat app?), and when genuinely unsure,
prefer the render_ui tool plus a self-contained plain-text reply over an
inline fence, since the tool path degrades safely everywhere and the fence
does not.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 280 lines · 98 tokens per session scan A e187128ebf9f
genui is a skill published in the GitHub repository open-octo/octo-agent (97 stars, last pushed yesterday), licensed MIT. It adds 98 tokens to every session and 4,175 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
claude-design
Design one-off HTML artifacts (landing, deck, prototype).
popular-web-designs
54 real design systems (Stripe, Linear, Vercel) as HTML/CSS.
design-sync
Push a React design system to claude.ai/design. This runs a converter that bundles the real component code (from Storybook or a bare package) and uploads it. Use when the user runs /design-sync or says "sync my design system to Claude Design".
html-artifacts
Author the HTML for a plan artifact, dashboard iframe, or Slack attachment — structure, design plan, available runtime, theming, and craft. Read this before writing HTML for saveplan, outputiframe, or slackattachhtml.
3d-object
Model a 3D object the user can inspect from every angle and download, built with three.js and presented in the threedstage starter.
frontend-design
Aesthetic direction for designs outside an existing brand system.