Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add porcupine-md/jonggrang --skill scaffold-deploygit clone --depth 1 https://github.com/porcupine-md/jonggrangWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/porcupine-md/jonggrang/scaffold-deploy)<a href="https://agentmods.dev/skills/porcupine-md/jonggrang/scaffold-deploy"><img src="https://agentmods.dev/badge/skills/porcupine-md/jonggrang/scaffold-deploy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/porcupine-md/jonggrang/scaffold-deploy"><img src="https://agentmods.dev/badge/skills/porcupine-md/jonggrang/scaffold-deploy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 37 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 77 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 78 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.00664 |
| Opus 5.5 | $0.00012 | $0.00266 |
| Sonnet 5.5 | $0.00006 | $0.00133 |
| Haiku 4.5 | $0.00003 | $0.00066 |
Grade A, and why
scaffold-deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Context
Project {{project_name}} ({{project_type}}) uses {{stack}}. Setup deployment to {{input.target}} with CI/CD via {{input.ci_provider}}.
Instructions
-
Create Dockerfile (if target = docker, railway, fly, aws, gcp)
- Multi-stage build (builder + runner)
- Non-root user
- Minimal image size (alpine if possible)
- Proper .dockerignore
- Health check endpoint
-
Create docker-compose.yml (for local development)
- App service
- Database service (if applicable)
- Redis service (if applicable)
- Volume mounts for development
- Environment variables from .env
-
Create CI/CD pipeline
GitHub Actions:
.github/workflows/ ├── ci.yml # Run on PR: lint, typecheck, test ├── deploy.yml # Run on push to main: build, deploy └── release.yml # Run on tag (library only): publishGitLab CI:
.gitlab-ci.yml # stages: test, build, deploy -
Create environment configs
.env.example(template, committed)- Document required env vars
- Separation: development, staging, production
-
Platform-specific config:
- Vercel:
vercel.json - Railway:
railway.toml - Fly.io:
fly.toml - Library: npm publish config in package.json
- Vercel:
Script
#!/bin/bash
# Create deployment directories
mkdir -p .github/workflows 2>/dev/null
# Create .dockerignore if using Docker
if [ "{{input.target}}" != "vercel" ]; then
cat > .dockerignore << 'DOCKERIGNORE'
node_modules
.git
.env
.env.local
dist
coverage
.next
DOCKERIGNORE
echo "Created .dockerignore"
fi
Validation
- Dockerfile builds successfully (
docker build .) - Container runs and responds to health check
- CI pipeline syntax valid
- CI pipeline runs successfully (lint, typecheck, test)
- .env.example contains all required variables
- No secrets hardcoded in any config file
- .dockerignore excludes sensitive files
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 96 lines · 29 tokens per session scan A 819900384de9
scaffold-deploy is a skill published in the GitHub repository porcupine-md/jonggrang (16 stars, last pushed 1mo ago), licensed MIT. It adds 29 tokens to every session and 664 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
atmos-profiles
Atmos profiles: profile directories, --profile and ATMOSPROFILE activation, profile merge behavior, environment switching, and routing profile-specific auth/toolchain/config overrides.
webhook-management
Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.
deployment-engineer
Expert deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. Masters GitHub Actions, ArgoCD/Flux, progressive delivery, container security, and platform engineering. Handles zero-downtime deployments, security scanning, and developer experience optimization.…
ci-fixer
CI failures - read error, minimal fix, verify.