Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OriginTrail/dkg --skill dkg-importergit clone --depth 1 https://github.com/OriginTrail/dkgWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/origintrail/dkg/dkg-importer)<a href="https://agentmods.dev/skills/origintrail/dkg/dkg-importer"><img src="https://agentmods.dev/badge/skills/origintrail/dkg/dkg-importer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/origintrail/dkg/dkg-importer"><img src="https://agentmods.dev/badge/skills/origintrail/dkg/dkg-importer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 16 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 485 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 675 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Rogue Agent · line 74 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 152 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 161 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 165 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.08676 |
| Opus 5 | $0.00044 | $0.04338 |
| Sonnet 5 | $0.00017 | $0.01735 |
| Haiku 4.5 | $0.00009 | $0.00868 |
Grade A, and why
dkg-importer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
res = requests.post(f'{BASE}/knowledge-assets', How it starts
The opening of the file, as written. The whole thing — 676 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DKG Importer Skill
This skill is the agent-readable manual for bulk imports against a DKG V10 node. If you are about to write more than a few thousand triples in one logical operation — a code graph, a Markdown corpus, a GitHub issue archive, a domain-specific dataset — read this first. It documents the contract every existing in-tree importer follows, so the graphs you produce join naturally with graphs other agents and the scanners produce.
For the general node API surface (auth, contextGraphs, SWM/VM publish, SPARQL)
see packages/cli/skills/dkg-node/SKILL.md. This skill
sits one layer above: it assumes you already know how to call dkg_knowledge_asset_*
and focuses on how to call them at scale, repeatedly, without losing data on
restart and without fragmenting the graph against parallel producers.
1. The chunking contract (read first)
The daemon's /api/knowledge-assets create + /api/knowledge-assets/<name>/{wm/write,swm/share} loop is the
chunked-write API. There is no /api/import/bulk and there will not be one
(see ADR 0002 for
the rejected-alternative analysis). To push a large graph you call the loop
many times, with each call staying under fixed budgets.
| Constant | Value | Where it lands |
|---|---|---|
CHUNK |
5,000 quads | Per POST /api/knowledge-assets/<name>/wm/write call |
ROOT_CHUNK |
400 URIs | Initial per-call batch for POST /api/knowledge-assets/<name>/swm/share; halve on the 4 MiB encoded-payload cap |
| Max concurrent writes within one assertion | 1 (sequential) | The daemon does not parallelise intra-assertion writes; the manifest in §3 tracks per-assertion state anyway |
| Max concurrent assertions | 4 | Safe across assertions; keeps memory bounded for laptop-class nodes |
These constants are conservative: a 5,000-quad N-Quads payload serialises at
roughly 1.0-1.5 MB, well under the daemon's 10 MB MAX_BODY_BYTES cap. Going
larger gives no throughput win and risks a 413 on URIs that serialise on the
heavy end.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed 09dbb39fc884
- 12d ago First seen · 676 lines · 87 tokens per session scan A 069fdfe1cb91
dkg-importer is a skill published in the GitHub repository OriginTrail/dkg (148 stars, last pushed today), licensed Apache-2.0. It adds 87 tokens to every session and 8,676 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nornicdb-rag-procedures
Build RAG pipelines in NornicDB using Cypher procedures — db.retrieve (hybrid vector + BM25 + RRF), db.rretrieve (retrieve + rerank), db.rerank (cross-encoder), db.infer (LLM call). Use when assembling end-to-end retrieval, reranking, or RAG flows from Cypher rather than hand-rolling vector and full-text procedures…
nornicdb-managed-embeddings
Use NornicDB managed embeddings via Cypher — server-side embedding generation with WITH EMBEDDING, db.index.vector.embed, embedding providers (Ollama / OpenAI / local GGUF), property include/exclude, and the managed ChunkEmbeddings storage model. Use when the API surface is Cypher and you want NornicDB to embed text…
nornicdb-vector-search
Run vector and full-text indexes from Cypher in NornicDB — CREATE/DROP VECTOR INDEX, CREATE/DROP FULLTEXT INDEX, db.index.vector.queryNodes / queryRelationships, db.index.fulltext.queryNodes, similarity functions, dimensions. Use when building semantic search, kNN, or BM25 lookups in NornicDB; the API is…
nornicdb-qdrant-migration
Migrate from Qdrant to NornicDB end-to-end through NornicDB's Qdrant-compatible gRPC surface. Covers connection setup, collection→database mapping, point→node mapping, the vector-config and named-vector replication, point upsert in batches, count verification, and what (deliberately) does not transfer (snapshots, HNSW…
attach-receipts
Attaches sourcedoc/extractionrunid/schemaversion receipts to every edge at write time, and refuses to write any edge missing one of the three.
embeddings
Vector embeddings with HNSW indexing, sql.js persistence, and hyperbolic support. 75x faster with agentic-flow integration. Use when: semantic search, pattern matching, similarity queries, knowledge retrieval. Skip when: exact text matching, simple lookups, no semantic understanding needed.