Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/phazurlabs/install-labs/framework-packaging-guidesnpx skills add phazurlabs/install-labs --skill framework-packaging-guidesgit clone --depth 1 https://github.com/phazurlabs/install-labsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phazurlabs/install-labs/framework-packaging-guides)<a href="https://agentmods.dev/skills/phazurlabs/install-labs/framework-packaging-guides"><img src="https://agentmods.dev/badge/skills/phazurlabs/install-labs/framework-packaging-guides.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00188 | $0.06970 |
| Opus 5 | $0.00094 | $0.03485 |
| Sonnet 5 | $0.00038 | $0.01394 |
| Haiku 4.5 | $0.00019 | $0.00697 |
Grade B, and why
framework-packaging-guides scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
**Install via API:** `curl -X POST http://localhost:3000/api/v1/chatflows -H "Content-Type: application/json" -d @chatflows/my_chatflow.json` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Install via API:** `curl -X POST http://localhost:3000/api/v1/chatflows -H "Content-Type: application/json" -d @chatflows/my_chatflow.json` How it starts
The opening of the file, as written. The whole thing — 621 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Framework-Specific Packaging Guides
How to turn an agent built with any major framework into something other people can install with one command.
1. LangChain / LangGraph
When to use: Stateful multi-step agents with tool calling, memory, and conditional branching. LangGraph adds explicit graph-based control flow.
Project structure:
my-langgraph-agent/
├── src/my_agent/
│ ├── __init__.py
│ ├── agent.py # graph definition
│ ├── nodes.py # node functions
│ ├── tools.py
│ └── state.py # TypedDict state schema
├── langgraph.json # deployment manifest
├── pyproject.toml
├── Dockerfile
├── docker-compose.yml
└── .env.example
Key configs:
// langgraph.json — required for langgraph deploy and Cloud
{ "graphs": {"my_agent": "./src/my_agent/agent.py:graph"}, "env": ".env", "python_version": "3.12", "dependencies": ["."] }
# pyproject.toml
[project]
name = "my-langgraph-agent"
dependencies = ["langgraph>=0.2.0", "langchain-anthropic>=0.2.0"]
[project.scripts]
my-agent = "my_agent.cli:main"
Distribution: LangGraph Cloud (langgraph deploy) | Docker (docker compose up -d) | PyPI (pip install my-langgraph-agent)
Pitfalls:
- Version conflicts. LangChain ships breaking changes frequently. Pin exact versions (
langgraph==0.2.14, not>=0.2). Users with other LangChain projects hit dependency hell. - Missing
langgraph.json. Without it,langgraph deploysilently fails or serves the wrong graph. - State schema not exported. Library consumers need your
StateTypedDict. Export it from__init__.py.
2. CrewAI
When to use: Multi-agent systems where each agent has a distinct role, goal, and backstory. Role-based collaboration (researcher + writer + editor).
Project structure:
my-crew/
├── src/my_crew/
│ ├── __init__.py
│ ├── crew.py # @CrewBase class
│ ├── agents.py
│ ├── tasks.py
│ ├── tools/custom_tool.py
│ └── config/
│ ├── agents.yaml
│ └── tasks.yaml
├── pyproject.toml
├── Dockerfile
└── .env.example
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 621 lines · 188 tokens per session scan B b33e5d711339
framework-packaging-guides is a skill published in the GitHub repository phazurlabs/install-labs (3 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 188 tokens to every session and 6,970 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
promptscript
PromptScript language expert for reading, writing, modifying, and troubleshooting .prs files. Use when working with PromptScript syntax, creating or editing .prs files, adding blocks like @identity, @standards, @restrictions, @shortcuts, @skills, or @agents, configuring promptscript.yaml, resolving compilation errors…
tdd-workflow
Test-driven development workflow.
expert
Base expert skill.
alpha
Alpha skill.
local-ci-dev
Run local CI via the in-tree dev build of local-ci (pnpm local-ci-dev) to verify changes to this repo before completing work. Runs pnpm local-ci-dev run --all in the background, watches the log for step failures, and retries failed runners after fixes. Use before reporting work as complete, or whenever the user asks…
local-ci
Run GitHub Actions workflows locally with pause-on-failure for AI-agent-driven CI iteration.