Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pantheon-org/tekhne --skill standards-to-toolinggit clone --depth 1 https://github.com/pantheon-org/tekhneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pantheon-org/tekhne/standards-to-tooling)<a href="https://agentmods.dev/skills/pantheon-org/tekhne/standards-to-tooling"><img src="https://agentmods.dev/badge/skills/pantheon-org/tekhne/standards-to-tooling/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pantheon-org/tekhne/standards-to-tooling"><img src="https://agentmods.dev/badge/skills/pantheon-org/tekhne/standards-to-tooling.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 194 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium MCP Rug Pull · line 138 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 147 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 141 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 148 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 144 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.02219 |
| Opus 5 | $0.00038 | $0.01110 |
| Sonnet 5 | $0.00015 | $0.00444 |
| Haiku 4.5 | $0.00008 | $0.00222 |
Grade A, and why
standards-to-tooling scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Standards to Tooling
Maps project-specific coding conventions to linting/formatting tool configuration. For the Stars project: JS/TS/Vue codebase with ESLint 10 + Prettier, migrating to full TypeScript.
Mindset
A convention that cannot be auto-enforced will drift. Before implementing any standard, always ask: Can a tool catch this? If yes, configure it. If no, document it as a code review checklist item.
Prefer tools that provide fix-on-save or --fix support — adoption is higher
when enforcement is automatic rather than manual.
When to Use
- Onboarding a new project and need to set up linting/formatting from scratch
- Adding a new code convention that should be machine-enforced
- Reviewing a PR where a convention was violated and a tool should catch it
- Migrating a codebase (e.g., JS → TS) and need to update or add tooling
- Standardising tooling across multiple projects or monorepo workspaces
Workflow
1. Discovery — Extract actionable standards
Source the project's conventions from:
| Source | What to look for |
|---|---|
AGENTS.md |
Naming, import style, component conventions, file structure |
.github/CONTRIBUTING.md |
PR requirements, commit style |
| Existing configs | Patterns already configured (eslint.config.js, .prettierrc, tsconfig.json) |
| Code review history | Repeated comments about the same issue |
| Project language docs | Best practices for the language/framework (Vue 3 style guide, etc.) |
For each convention, classify it:
| Category | Example | Tool |
|---|---|---|
| Naming | kebab-case files, PascalCase components | ESLint, lint-staged |
| Imports | type imports, .js extensions, ordering |
ESLint, Prettier plugins |
| Formatting | single quotes, trailing commas, print width | Prettier |
| Types | no implicit any, strict null checks | TypeScript tsconfig.json |
| Unused code | no unused vars, params, imports | ESLint |
| Style | no-var, prefer-const, no console.log | ESLint |
| Vue | <script setup> only, component name casing |
eslint-plugin-vue |
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/eval-set.json 2.5 KB
- evals/instructions.json 1.6 KB
- evals/scenario-01/capability.txt 72 B
- evals/scenario-01/criteria.json 634 B
- evals/scenario-01/task.md 939 B
- evals/scenario-02/capability.txt 54 B
- evals/scenario-02/criteria.json 602 B
- evals/scenario-02/task.md 978 B
- evals/scenario-03/capability.txt 73 B
- evals/scenario-03/criteria.json 607 B
- evals/scenario-03/task.md 1.1 KB
- evals/scenario-04/capability.txt 66 B
- evals/scenario-04/criteria.json 642 B
- evals/scenario-04/task.md 1.1 KB
- evals/scenario-05/capability.txt 88 B
- evals/scenario-05/criteria.json 666 B
- evals/scenario-05/task.md 1.1 KB
- evals/scenario-06/capability.txt 83 B
- evals/scenario-06/criteria.json 662 B
- evals/scenario-06/task.md 1.1 KB
- evals/scenario-07/capability.txt 95 B
- evals/scenario-07/criteria.json 607 B
- evals/scenario-07/task.md 1.1 KB
- evals/scenario-08/capability.txt 85 B
- evals/scenario-08/criteria.json 741 B
- evals/scenario-08/task.md 1.2 KB
- evals/summary.json 158 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 209 lines · 76 tokens per session scan A 62e7f3a55fa5
standards-to-tooling is a skill published in the GitHub repository pantheon-org/tekhne (10 stars, last pushed yesterday), licensed MIT. It adds 76 tokens to every session and 2,219 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
sonarjs
Use SonarJS-derived rules in .NET repositories that ship JavaScript or TypeScript frontends and need deeper bug-risk, code-smell, or cognitive-complexity checks than a minimal ESLint baseline. USE FOR: SonarQube, SonarCloud, or eslint-plugin-sonarjs setups; frontend code smells; cognitive complexity and deeper…
remotion-saas
Building video apps with Remotion - framework, rendering and Player advice.
vue-best-practices
A review checklist for Vue 2 and Vue 3 components, covering component names, prop declarations, TypeScript casts, API styles and complex template expressions.
nuxt
Nuxt full-stack Vue framework with SSR, auto-imports, and file-based routing. Use when working with Nuxt apps, server routes, useFetch, middleware, or hybrid rendering.
vue-router-best-practices
Vue Router 4 patterns, navigation guards, route params, and route-component lifecycle interactions.
critique
Design lens critique covering visual hierarchy, clarity, and anti-slop patterns — produces a findings table, no code edits unless asked. Use when the user wants a design review, says "what's wrong with this UI", or needs a second opinion before a handoff or presentation. Invoke when the user asks for critique on their…