Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Pantani/tdmcpnpx agentmods add skills/pantani/tdmcp/td-feature-buildWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pantani/tdmcp/td-feature-build)<a href="https://agentmods.dev/skills/pantani/tdmcp/td-feature-build"><img src="https://agentmods.dev/badge/skills/pantani/tdmcp/td-feature-build/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pantani/tdmcp/td-feature-build"><img src="https://agentmods.dev/badge/skills/pantani/tdmcp/td-feature-build.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 61 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01049 |
| Opus 5 | $0.00050 | $0.00524 |
| Sonnet 5 | $0.00020 | $0.00210 |
| Haiku 4.5 | $0.00010 | $0.00105 |
Grade A, and why
td-feature-build scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- td-feature-build — 100% identical, 0 lines differ
- td-feature-build — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
td-feature-build — implement one tool, new files only
Implement exactly what the spec says, in your own files, green in isolation. The parallel-build contract is simple: new files only; never edit anything shared (layer*/index.ts, tools/index.ts, cli/agent.ts, docs). That isolation is what lets builders run concurrently.
The canonical tool-file pattern
Every tool file exports a pure …Impl and a register…. Mirror a neighbour in the same layer, but the shape is:
import { z } from "zod";
import type { ToolRegistrar } from "../types.js"; // note the .js extension
import { runBuild, errorResult } from "../result.js";
export const fooSchema = z.object({
name: z.string().default("foo"),
intensity: z.number().min(0).max(1).default(0.5),
});
export async function fooImpl(ctx: ToolContext, args: z.infer<typeof fooSchema>) {
// build via the client; never throw — return errorResult / runBuild on failure
}
export const registerFoo: ToolRegistrar = (server, ctx) =>
server.registerTool(
"create_foo",
{ title: "…", description: "…", inputSchema: fooSchema.shape },
(args) => fooImpl(ctx, args),
);
ctx is the ToolContext ({ client, knowledge, recipes, logger, vault?, allowRawPython }). …Impl is pure and unit-testable with a mocked client.
Hard rules
- Never throw out of a handler. Validate via the Zod schema; turn TD failures into friendly
isErrorresults witherrorResult/runBuild/friendlyTdError. Return, don't throw. .jsimport extensions on every relative import (ESM/NodeNext).noUncheckedIndexedAccessis on — guard indexed access.- Biome: 2-space, double quotes, semicolons, trailing commas, 100-col. Check with
./node_modules/.bin/biome check <yourfiles>directly —npm run lintfails with a false ESLint parse error under the RTK proxy. - New files only. Your tool file +
tests/unit/<feature>.test.ts. Do not touch shared files; report your export names to the integrator instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 66 lines · 100 tokens per session scan A a2b603306cd7
td-feature-build is a skill published in the GitHub repository Pantani/tdmcp (39 stars, last pushed 25d ago), licensed MIT. It adds 100 tokens to every session and 1,049 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
backend/testing-guide
A guide for writing backend tests: small unit tests, tests that check connected parts such as an API and database, and end-to-end tests that follow a complete user flow.
321-frameworks-spring-boot-testing-unit-tests
Use when you need to write unit tests for Spring Boot applications — including pure unit tests with @ExtendWith(MockitoExtension.class) for @Service/@Component, slice tests with @WebMvcTest and @MockBean for controllers, @JsonTest for JSON serialization. For framework-agnostic Java use @131-java-testing-unit-testing.…
nestjs-testing-expert
NestJS testing mechanics with Jest — building testing modules, mocking providers and repositories, writing service and controller specs, and driving HTTP end-to-end tests through the real application. Use for any test touching a NestJS service, controller, guard, module, or API endpoint, including test-module setup…
mocking-assistant
Creates stable mocks for APIs, services, and UI components using MSW (Mock Service Worker), fixture conventions, and example patterns. Use for "API mocking", "MSW", "test mocks", or "service mocking".
web3-testing
Test smart contracts comprehensively using Hardhat and Foundry with unit tests, integration tests, and mainnet forking. Use when testing Solidity contracts, setting up blockchain test suites, or validating DeFi protocols.
temporal-python-testing
Test Temporal workflows with pytest, time-skipping, and mocking strategies. Covers unit testing, integration testing, replay testing, and local development setup. Use when implementing Temporal workflow tests or debugging test failures.