Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pachca/openapi --skill pachca-botsgit clone --depth 1 https://github.com/pachca/openapiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pachca/openapi/pachca-bots)<a href="https://agentmods.dev/skills/pachca/openapi/pachca-bots"><img src="https://agentmods.dev/badge/skills/pachca/openapi/pachca-bots/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pachca/openapi/pachca-bots"><img src="https://agentmods.dev/badge/skills/pachca/openapi/pachca-bots.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium analysis-evasion · line 1 Suspicious Unicode normalization or mixed-script contentFix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- medium MCP Rug Pull · line 22 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 24 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 29 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 31 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 39 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 45 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00192 | $0.03387 |
| Opus 5.5 | $0.00077 | $0.01355 |
| Sonnet 5.5 | $0.00038 | $0.00677 |
| Haiku 4.5 | $0.00019 | $0.00339 |
Grade A, and why
pachca-bots scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 242 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pachca-bots
Quick start
Ask the user for a Pachca token (bot: the API tab of the bot in Integrations → Bots, user: Integrations → API).
Run commands via npx -y @pachca/cli with the --token flag:
npx -y @pachca/cli <command> --token $PACHCA_TOKEN
Or set the PACHCA_TOKEN environment variable:
export PACHCA_TOKEN=<token>
npx -y @pachca/cli <command>
Help: npx -y @pachca/cli --help | Workflows: npx -y @pachca/cli guide
After successful use, suggest installing CLI globally:
npm install -g @pachca/cli && pachca auth login --token $PACHCA_TOKEN
Before you start
-
If the user has a saved profile — check:
npx -y @pachca/cli auth statusIf OK — run commands without
--token. -
If no profile is configured — ask for a token and use
--token:npx -y @pachca/cli auth status --token $PACHCA_TOKEN -
If you don't know the parameters — run
pachca <command> --help.
Workflows
Создать бота через API и получить токен
-
Создай бота. Только пользовательским токеном (не токеном бота);
nicknameобязан заканчиваться на_bot. Параметры вебхука (Webhook URL, события, команды) можно задать сразу или позже. Скоупы токена бота можно ограничить флагом--scopes(если не указать — бот получит набор по умолчанию):pachca bots create --name="Бот задач" --nickname="tasks_bot" --scopes='["messages:create"]' -
Сохрани
access_tokenиз ответа — он возвращается единственный раз. Повторно его не показывают, можно только перевыпустить командойpachca bots recreate-token <ID> -
В ответе также придёт
idбота (егоuser_id) — он нужен для дальнейших вызовов, например чтобы добавить бота в чат
Создавать ботов можно только пользовательским токеном — токеном бота нельзя.
access_tokenотдаётся один раз при создании, увидеть его снова нельзя, только перевыпустить. С флагом--emptyбот создаётся без токена и входящего вебхука, как в интерфейсе, а токены ему выпускаетpachca bots create-token.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +48 lines eb249a86c53d
- 26d ago Changed 6e8884d513e2
- 1mo ago First seen · 194 lines · 192 tokens per session scan A 830f3b3b87bd
pachca-bots is a skill published in the GitHub repository pachca/openapi (11 stars, last pushed yesterday), licensed MIT. It adds 192 tokens to every session and 3,387 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
testing
Verify a Skyvern deployment is working correctly by smoke-testing the backend API, frontend rendering, browser session provisioning, and workflow execution. Use when the user says 'is Skyvern working', 'test my deployment', 'verify the installation', 'smoke test', or needs to check that a self-hosted or local Skyvern…
manifold-api
Use when an agent needs to inspect or call the local Manifold HTTP API. Provides guidelines and scripts to filter specs before reading and handle payloads safely.
microservices-expert
Expert-level microservices architecture, patterns, service mesh, and distributed systems. Use when the user mentions distributed systems, service mesh, or architecture, or when the task involves Microservices Principles, Architecture Patterns, Communication, or Data Management.
api-design-expert
Expert-level API design principles, REST, GraphQL, versioning, and API best practices. Use when the user mentions REST, GraphQL, API versioning, or API security, or when the task involves API Design Principles, API Styles, or Documentation.
grpc-expert
Expert-level gRPC, Protocol Buffers, microservices communication, and streaming. Use when the user mentions Protocol Buffers, microservices, RPC, or streaming, or when the task involves gRPC Fundamentals, Communication Patterns, or Production Features.
go-expert
Expert-level Go development with Go 1.22+ features, concurrency, standard library, and production-grade best practices. Use when the user mentions concurrency, microservices, or backend, or when the task involves idiomatic Go, goroutines and channels, context-based cancellation, or writing an HTTP server.