Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pixijs/pixijs-skills --skill pixijs-creategit clone --depth 1 https://github.com/pixijs/pixijs-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pixijs/pixijs-skills/pixijs-create)<a href="https://agentmods.dev/skills/pixijs/pixijs-skills/pixijs-create"><img src="https://agentmods.dev/badge/skills/pixijs/pixijs-skills/pixijs-create/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pixijs/pixijs-skills/pixijs-create"><img src="https://agentmods.dev/badge/skills/pixijs/pixijs-skills/pixijs-create.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 8 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 7 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 17 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Prompt Injection · line 104 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 107 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 108 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 110 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 109 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 111 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00173 | $0.02138 |
| Opus 5 | $0.00086 | $0.01069 |
| Sonnet 5 | $0.00035 | $0.00428 |
| Haiku 4.5 | $0.00017 | $0.00214 |
Grade A, and why
pixijs-create scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- pixi-create — 98% identical, 2 lines differ
How it starts
The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.
create pixi.js is the official CLI for scaffolding a new PixiJS v8 project. Run it with any package manager (npm, yarn, pnpm, bun) and pick a template from the interactive menu, or pass --template to skip prompts. It writes a self-contained project folder; you then cd in, install dependencies, and run the dev script.
Quick Start
Scaffold a new project with interactive prompts:
npm create pixi.js@latest
Or skip prompts by passing a project name and template:
npm create pixi.js@latest my-game -- --template bundler-vite
Then:
cd my-game
npm install
npm run dev
Requires Node.js 18+ or 20+. Some templates (notably creation-web and framework-react) may require a newer Node version; the package manager will warn if so.
Adding PixiJS to an existing project
If you already have a bundler, framework, or project set up, skip the CLI and install the package directly:
npm install pixi.js
Then import from pixi.js and construct an Application as shown in pixijs-application. The CLI templates are a convenience for new projects; they don't add anything to the library that npm install pixi.js can't give you.
Related skills: pixijs-application (how the scaffolded new Application() + app.init() entry point works), pixijs-core-concepts (renderers and the render loop), pixijs-scene-core-concepts (scene graph fundamentals for the first things you'll add to the stage), pixijs-assets (loading textures, fonts, and bundles the template expects you to drop into public/ or src/assets/).
Core Patterns
Choose a package manager
The command is the same shape for every package manager:
npm create pixi.js@latest
yarn create pixi.js
pnpm create pixi.js
bun create pixi.js
Under npm 7+ you must pass a -- before CLI flags so npm doesn't consume them:
npm create pixi.js@latest my-game -- --template bundler-vite
Yarn, pnpm, and bun don't need the extra separator:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 208 lines · 173 tokens per session scan A 9b1d9f36fbe2
pixijs-create is a skill published in the GitHub repository pixijs/pixijs-skills (329 stars, last pushed 3mo ago), licensed MIT. It adds 173 tokens to every session and 2,138 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gameobject-component-destroy
Destroy one or more Components from a target GameObject. Missing (null) components are skipped — they cannot be destroyed. Use 'gameobject-find' and 'gameobject-component-get' to identify the components first.
unity-version-split
Split a C# file into Unity 6.5+ and pre-Unity 6.5 variants. Use when a file needs different implementations for different Unity versions due to API changes (e.g., EntityId vs int, GetEntityId vs GetInstanceID).
godot-signals-groups
Build event-driven, decoupled Godot 4.7 gameplay with signals and node groups: declare and emit custom signals, connect with Callables (incl. bind/one-shot), and broadcast to many nodes via groups and callgroup. Use when wiring node communication in a Godot project, replacing tight references with signals…
unity-addressables
Manage Addressables groups, entries, profiles and content builds (com.unity.addressables, reflection-based).
motion
How an agent turns a character mesh into a usable animated FBX — and how to judge whether the result is shippable.
threejs-exposure-color-grading
Build a measured exposure and grading path in Three.js. Use for a 64x36 encoded luminance meter, asynchronous readback, weighted log-average exposure, asymmetric adaptation, single tone-map ownership, and a generated 32-cube post-tone-map LUT.