Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Poppify/poppify-claude-plugin --skill poppify-text-cardgit clone --depth 1 https://github.com/Poppify/poppify-claude-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/poppify/poppify-claude-plugin/poppify-text-card)<a href="https://agentmods.dev/skills/poppify/poppify-claude-plugin/poppify-text-card"><img src="https://agentmods.dev/badge/skills/poppify/poppify-claude-plugin/poppify-text-card/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/poppify/poppify-claude-plugin/poppify-text-card"><img src="https://agentmods.dev/badge/skills/poppify/poppify-claude-plugin/poppify-text-card.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01394 |
| Opus 5 | $0.00058 | $0.00697 |
| Sonnet 5 | $0.00023 | $0.00279 |
| Haiku 4.5 | $0.00012 | $0.00139 |
Grade D, and why
poppify-text-card scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X PUT -H "Content-Type: image/png" --data-binary @/tmp/poppify-card/slide.png "<uploadUrl>" Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /tmp/poppify-card Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X PUT -H "Content-Type: image/png" --data-binary @/tmp/poppify-card/slide.png "<uploadUrl>" How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Poppify text card (local render — a Claude Code capability)
Text-primary slides — install commands, code, terminal frames, stat callouts, exact headlines/URLs/brand names — must never go through add_slide_image (diffusion garbles literal text). On a shell-capable client you render them as a pixel-perfect HTML/CSS card and screenshot it. Zero seeds, ~30s per card.
Capability gate — check FIRST
This skill needs a shell plus a headless browser (Chrome / Chromium / Edge) or Playwright. This is a Claude Code capability.
- No Bash/shell tool (Claude Desktop, web)? STOP — don't use this skill. Instead: put the text in
update_slides({action:"set_text", slideIndex, newText})and let the composer draw it as a caption (crispdrawtext, not diffusion — it does not garble text). Only reach for a rendered card when the typography is genuinely special (multi-line code, exact terminal frame); if so, ask the user to supply the card image and ingest it withupload_asset({..., sourceUrl})/upload_asset({..., dataBase64}). - Shell present but no browser? Try
npx playwright screenshot(downloads Chromium on first run), else fall back to the composer caption above.
Step 1 — write the styled HTML (target 1080×1920 for 9:16)
mkdir -p /tmp/poppify-card
cat > /tmp/poppify-card/slide.html << 'EOF'
<!DOCTYPE html>
<html><head><meta charset="utf-8"><style>
html,body { margin:0; padding:0; }
body { width:1080px; height:1920px; background:#0d0518; color:#f0eef6;
font-family:'SF Mono',Menlo,Consolas,'DejaVu Sans Mono',monospace; }
.frame { width:1080px; height:1920px; padding:120px; box-sizing:border-box;
display:flex; align-items:center; }
.cmd { font-size:48px; line-height:1.4; }
.cursor { color:#a78bfa; animation: blink 1s steps(2) infinite; }
@keyframes blink { 50% { opacity: 0; } }
</style></head><body><div class="frame"><div class="cmd">
$ claude mcp add poppify https://poppify.ai/mcp<span class="cursor">_</span>
</div></div></body></html>
EOF
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 95 lines · 116 tokens per session scan D 3dfb4a71ccc8
poppify-text-card is a skill published in the GitHub repository Poppify/poppify-claude-plugin (0 stars, last pushed 1mo ago), licensed MIT. It adds 116 tokens to every session and 1,394 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it D with 3 findings (sends data to an external url, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
lanshu-create-ai-presenter-video
Turn a topic or finished script plus an authorized adult presenter image into a complete, publish-ready AI presenter video. Use for new presenter videos and for continuing, revising, captioning, lip-sync repairing, or re-exporting an existing presenter-video job. Keep model and provider selection capability-based and…
video-podcast-maker
Use when the user gives a topic and wants an automated topic-driven narrated explainer, podcast, or knowledge-summary video (Bilibili / YouTube / Xiaohongshu / Douyin / WeChat Channels), or asks to learn visual design patterns from a reference video/image. Trigger when the user mentions creating a knowledge video…
video-podcast-maker-lite
Minimal personal narrated-video pipeline — a topic becomes a talking-head-free explainer MP4 (1080p or 4K) via script → Azure TTS (SSML) → Remotion. Use when the user wants a quick narrated video from a topic without the full video-podcast-maker machinery (no extra skills, no thumbnails/shorts/publish matrix). Do NOT…
video-podcast-maker-nano
Smallest personal narrated-explainer-video pipeline (spoken narration over visuals, not an audio podcast), fully tool-agnostic and autonomous by default — topic → research ∥ asset collection → script → TTS → video → 4K render ∥ publish info + cover. The skill defines the pipeline logic and self-verified checkpoints…
video-podcast-maker-factory
Use when the user wants to create their own custom narrated-video pipeline skill — a personal video-podcast-maker-xxx variant with their own TTS backend, visual style, and review gates. Forks the lite reference implementation. Do NOT trigger for making an actual video (use the user's existing variant) or for full…
travel-skill
A production guide for realistic travel-promotion videos that combine authorised real footage with AI-generated shots.