Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/osouthgate/agent-plus/skill-plusnpx skills add osouthgate/agent-plus --skill skill-plusgit clone --depth 1 https://github.com/osouthgate/agent-plusWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00104 | $0.01632 |
| Opus 5 | $0.00052 | $0.00816 |
| Sonnet 5 | $0.00021 | $0.00326 |
| Haiku 4.5 | $0.00010 | $0.00163 |
Grade B, and why
skill-plus scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
description: agent-plus | Mine the Claude Code session log to find commands the user keeps typing by hand, then scaffold them into proper Claude skills under `.claude/skills/<name>/`. Read-only audit of existing skills a How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skill-plus
The fifth universal primitive of agent-plus. Turns repeated Bash patterns from real Claude Code sessions into project-scoped Claude skills, audits the skills you already have, and feeds back two streams of evidence (explicit ratings + implicit failure signals) into one quality loop.
The binary lives at ${CLAUDE_SKILL_DIR}/../../bin/skill-plus; the plugin auto-adds bin/ to PATH, so call it as skill-plus.
When to reach for this
Mining loop:
# First time in a project — grant consent (one-shot per project)
skill-plus scan --accept-consent
# Show ranked candidates from the candidate log
skill-plus propose --pretty
# Cadence lens: schedulable routines vs diffuse habits (from the same scan)
skill-plus propose --kind all --pretty
skill-plus routine --adopt <id> # you set this routine up -> stop suggesting it
skill-plus routine --dismiss <id> # not useful -> de-rank
# Scaffold the top candidate into a real skill
skill-plus scaffold railway-probe \
--from-candidate 8ad12e3f9be1 \
--description "One-shot Railway error probe across services" \
--when-to-use "Triggers on 'is staging green' / 'why is api 500ing' / 'check railway errors'" \
--do-not-use-for "deploys; env-var management; logs over 1h windows"
# Make scanning continuous (weekly)
skill-plus install-cron --frequency weekly
Audit + feedback loop:
# What's in this project, scored against the contract
skill-plus list --pretty
# Where are agents falling back from existing plugins? Where's the discoverability gap?
skill-plus feedback --pretty
# Single skill deep-dive
skill-plus feedback --skill repo-analyze --pretty
Marketplace lifecycle:
# Default is dry-run — see the plan
skill-plus promote railway-probe --to osouthgate/agent-plus-skills
# Ship it — copies into the marketplace clone, mutates marketplace.json#skills,
# removes the project-local copy unless --keep-local
skill-plus promote railway-probe --to osouthgate/agent-plus-skills --no-dry-run
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 92 lines · 104 tokens per session scan B 5c711f15b322
skill-plus is a skill published in the GitHub repository osouthgate/agent-plus (4 stars, last pushed 1mo ago), licensed MIT. It adds 104 tokens to every session and 1,632 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
add-provider
Add or extend an open-source OOMOL Connect provider under src/providers, including provider definition, action schemas, local executors, credential validation, examples, and generated catalog updates.
inkbox-python
Use when writing Python code that imports from inkbox, uses pip install inkbox, or when adding email, mailbox imports, phone, text/SMS, iMessage, A2A task/message history, contacts, notes, contact rules, vault, tunnels, mailbox storage, mail clients (IMAP/SMTP), or agent identity features using the Inkbox Python SDK.
trustabl-enrich
Enriches source files flagged by a Trustabl scan — adds what is missing and corrects what is wrong, guided entirely by the scan's own explanation and fix text. Use after trustabl scan to apply findings directly to source files without manual editing.
trustabl-scan
Use right after you write or modify AI agent, tool, subagent, or MCP-server code (OpenAI Agents SDK, Claude Agent SDK, Google ADK, MCP) to self-audit it for security and reliability misconfigurations with Trustabl before committing. Triggers on adding or editing an agent definition, a tool / @functiontool / @tool /…
claude-skill-safety
High-risk patterns in Claude Code Agent Skills (SKILL.md): auto-approved shell, pre-model dynamic-context execution,…
inkbox-all
Index of all Inkbox skills in this repository, including the example skills under examples/, with GitHub links and short guidance on when to use each one.