Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/phazurlabs/install-labs/agent-packaging-foundationsnpx skills add phazurlabs/install-labs --skill agent-packaging-foundationsgit clone --depth 1 https://github.com/phazurlabs/install-labsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phazurlabs/install-labs/agent-packaging-foundations)<a href="https://agentmods.dev/skills/phazurlabs/install-labs/agent-packaging-foundations"><img src="https://agentmods.dev/badge/skills/phazurlabs/install-labs/agent-packaging-foundations.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.02371 |
| Opus 5 | $0.00033 | $0.01185 |
| Sonnet 5 | $0.00013 | $0.00474 |
| Haiku 4.5 | $0.00007 | $0.00237 |
Grade B, and why
agent-packaging-foundations scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Requiring `sudo pip install` or `sudo npm install -g`. Install to user space. If you need system access, explain exactly why. How it starts
The opening of the file, as written. The whole thing — 241 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Packaging Foundations
Why Agents Are Harder to Package Than Traditional Software
Traditional software has a single runtime, a known dependency tree, and a build artifact. AI agents break every assumption:
| Challenge | Traditional Software | AI Agents |
|---|---|---|
| Secrets | Maybe one DB connection string | 3-8 API keys across providers (OpenAI, Anthropic, Pinecone, etc.) |
| Model weights | No large binary blobs | 500MB-70GB model files that can't ship in a package |
| Runtime environment | One language runtime | Python + Node.js + system libs + CUDA/Metal |
| Config sprawl | One config file | .env, config.yaml, plugin.json, mcp.json, framework configs, all in different directories |
| Framework churn | Stable APIs | LangChain, CrewAI, AutoGen — breaking changes monthly |
| Hardware variance | CPU is CPU | GPU type, VRAM, quantization level all affect behavior |
| State | Database handles it | Vector stores, conversation memory, tool caches across restarts |
The result: an agent that works on the author's machine silently depends on 15 things the author forgot they installed.
8 Core Packaging Principles for Agents
1. One Command to Install, One Command to Uninstall
# GOOD: single entry point
npx @your-org/my-agent install
npx @your-org/my-agent uninstall
# GOOD: platform package manager
brew install my-agent && brew uninstall my-agent
# BAD: multi-step scavenger hunt
git clone ... && cd ... && pip install -r ... && cp config.example.yaml ...
If your install instructions have more than one step, wrap them in a script.
2. Secrets via Environment Variables, Never Hardcoded
# GOOD: read at runtime
OPENAI_API_KEY=sk-... my-agent start
# GOOD: .env file (gitignored)
my-agent init # creates .env template with comments
# BAD: baked into config
# config.yaml: api_key: "sk-proj-abc123..."
Ship a .env.example with every key listed, commented, and explained. Never write a real key to disk in plaintext unless the user explicitly opts in.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 241 lines · 66 tokens per session scan B 21f5dd666d83
agent-packaging-foundations is a skill published in the GitHub repository phazurlabs/install-labs (3 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 66 tokens to every session and 2,371 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tdd-workflow
Test-driven development workflow.
expert
Base expert skill.
alpha
Alpha skill.
local-ci-dev
Run local CI via the in-tree dev build of local-ci (pnpm local-ci-dev) to verify changes to this repo before completing work. Runs pnpm local-ci-dev run --all in the background, watches the log for step failures, and retries failed runners after fixes. Use before reporting work as complete, or whenever the user asks…
local-ci
Run GitHub Actions workflows locally with pause-on-failure for AI-agent-driven CI iteration.
local-ci
Run GitHub Actions CI locally with Local CI to validate changes before pushing. Use when testing, running checks, or validating code changes.