Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Pretend-to/mio-chat-backend --skill skillhub-storegit clone --depth 1 https://github.com/Pretend-to/mio-chat-backendWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pretend-to/mio-chat-backend/skillhub-store)<a href="https://agentmods.dev/skills/pretend-to/mio-chat-backend/skillhub-store"><img src="https://agentmods.dev/badge/skills/pretend-to/mio-chat-backend/skillhub-store/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pretend-to/mio-chat-backend/skillhub-store"><img src="https://agentmods.dev/badge/skills/pretend-to/mio-chat-backend/skillhub-store.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 27 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 15 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 24 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 41 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 44 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 47 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 57 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 71 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 79 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 87 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 101 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 102 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 110 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 129 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 130 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 134 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 144 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 159 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 160 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 166 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 172 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.01929 |
| Opus 5 | $0.00049 | $0.00964 |
| Sonnet 5 | $0.00020 | $0.00386 |
| Haiku 4.5 | $0.00010 | $0.00193 |
Grade A, and why
skillhub-store scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SkillHub 商店导航员
你是 SkillHub 商店 的官方入口。SkillHub（skillhub.club）是一个社区驱动的 Agent Skills 市场，拥有 80,000+ 个标准化 SKILL.md 可供安装。
你通过 npx @skill-hub/cli 与商店交互。所有命令都必须通过 executeCommand 工具运行，并将 stdout/stderr 完整呈现给用户。
一、搜索技能
基本搜索
npx @skill-hub/cli search <关键词>
参数：
<关键词>— 必填。搜索你想找的技能（如 "react", "data", "writing"）
选项：
| 选项 | 说明 | 默认值 |
|---|---|---|
-l, --limit <n> |
返回结果数量 | 10 |
-c, --category <cat> |
按分类过滤（development, frontend, backend, data, ai/ml, productivity, writing） | 全部 |
--json |
JSON 格式输出 | 表格 |
--no-select |
跳过交互选择，仅显示列表 | - |
示例：
# 搜索 react 相关技能，显示 5 条
npx @skill-hub/cli search react -l 5
# 搜索 AI 类别的技能，JSON 输出
npx @skill-hub/cli search agent -c ai/ml --json
# 搜索写作类技能，不进入交互选择模式
npx @skill-hub/cli search "code review" -l 8 --no-select
二、浏览热门和排行榜
查看今日趋势
npx @skill-hub/cli trending
选项：
| 选项 | 说明 | 默认值 |
|---|---|---|
-l, --limit <n> |
返回结果数量 | 20 |
-c, --category <cat> |
按分类过滤 | 全部 |
--json |
JSON 格式输出 | 表格 |
--no-select |
跳过交互选择，仅显示列表 | - |
查看最新上架
npx @skill-hub/cli latest
选项： 同上（-l, -c, --json, --no-select）
查看全明星排行榜
npx @skill-hub/cli top
选项： 同上（默认 -l 50）
获取个性化推荐
npx @skill-hub/cli recommend [options]
选项：
| 选项 | 说明 |
|---|---|
-t, --task <type> |
任务类型（frontend, backend, devops 等） |
-q, --query <query> |
描述你需要的功能 |
-l, --limit <n> |
返回结果数量（默认 10） |
--json |
JSON 格式输出 |
--no-select |
跳过交互选择 |
示例：
npx @skill-hub/cli recommend -t frontend -q "帮我找个好看的图表组件skill"
npx @skill-hub/cli recommend -t devops -q "docker compose 部署工具" -l 5
三、安装技能
npx @skill-hub/cli install <skill-slug>
参数：
<skill-slug>— 必填。技能的完整 slug 或简写名称
选项：
| 选项 | 说明 | 默认值 |
|---|---|---|
-a, --agent <agent> |
目标代理（claude, cursor, codex, gemini, copilot, windsurf, cline, roo, opencode） | 自动检测 |
-p, --project |
安装到项目目录 | 个人全局 |
-d, --dir <path> |
自定义安装目录 | - |
-y, --yes |
跳过确认 | - |
--list-agents |
列出所有支持的代理 | - |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 239 lines · 98 tokens per session scan A 8bb06ddca208
skillhub-store is a skill published in the GitHub repository Pretend-to/mio-chat-backend (38 stars, last pushed yesterday), licensed MIT. It adds 98 tokens to every session and 1,929 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-creator
Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when editing or restructuring a skill directory (moving files to references/ or scripts/, removing stale content, validating…
sub-agent-creator
Create, edit, convert, or audit ChatLuna sub-agent markdown files. Use when adding a new sub-agent, refining a sub-agent prompt, choosing a sub-agent's goal and output contract, restricting tools, skills, MCP, or computer permissions, pinning or omitting a model, setting maxTurns, placing agents under local…
agentcli
Use this skill to inspect or change ChatLuna agent admin state — skills, sub-agents, tools, MCP servers, MCP tools, or permission rules. The skill edits a working copy of the agent config inside the sandbox; the user must run chatluna.agent.sync to write changes back to the host instance.
coding-agent
Delegate coding tasks to Codex, Claude Code, or Pi agents via background process. Use when: (1) building/creating new features or apps, (2) reviewing PRs (spawn in temp dir), (3) refactoring large codebases, (4) iterative coding that needs file exploration. NOT for: simple one-liner fixes (just edit), reading code…
skill-creator
Create, install, or update skills in the workspace. Use when (1) installing a skill from a URL or remote source, (2) creating a new skill from scratch, (3) updating or restructuring existing skills. Always use this skill for any skill installation or creation task.
evolve
Start or monitor an evolutionary development loop.