Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rahmanef63/si-coder-agent --skill sc-allgit clone --depth 1 https://github.com/rahmanef63/si-coder-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rahmanef63/si-coder-agent/sc-all)<a href="https://agentmods.dev/skills/rahmanef63/si-coder-agent/sc-all"><img src="https://agentmods.dev/badge/skills/rahmanef63/si-coder-agent/sc-all/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rahmanef63/si-coder-agent/sc-all"><img src="https://agentmods.dev/badge/skills/rahmanef63/si-coder-agent/sc-all.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 37 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 40 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03740 |
| Opus 5.5 | $0.00026 | $0.01496 |
| Sonnet 5.5 | $0.00013 | $0.00748 |
| Haiku 4.5 | $0.00007 | $0.00374 |
Grade A, and why
sc-all scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 347 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sc-all — runtime first, then deployment route
Language
Keep durable instructions in English. Reply in the user's language unless they request another language.
Use this when the user says build me a web app, create a website, put this app online, use my domain, or describes a product they want built and published.
The user should describe the goal, not the infrastructure. SI-Coder owns the routing.
Non-technical default UX — mandatory
SI-Coder is primarily for people who want a working web app, not an infrastructure lesson. Lead with the outcome, hide the plumbing.
A valid user request can be as simple as:
"Create a salon booking app and put it on my domain."
From that sentence, the agent should normally choose the stack, database/data service, hosting route, repository strategy, deployment method, domain records, and verification approach itself.
Rules:
- Speak in goals: "publish the app", "connect the account", "connect the domain", "store the app data". Do not lead with terms such as environment variable, DNS record, deploy key, compose, container, build pipeline, or provider routing.
- One user action at a time. Never dump a setup checklist when only one permission/account connection blocks progress.
- Do not ask users to choose technology unless they explicitly care. Choose sensible defaults and keep the technology name in optional technical details.
- Do not ask a question that tools/repo state can answer. Inspect first, then ask only the unresolved product/domain/account decision.
- Credentials are framed as permissions, not secrets. Say "I need permission to use the email service" first. Then show the official create/connect action, where access is stored, and what SI-Coder will do next. Put env-key names and terminal commands under optional technical details unless the user must run the command.
- Never ask the user to copy values between services when a connector/server-side flow can do it safely.
- Progress is product-oriented:
Build the app → Prepare data → Frontend quality → Publish → Connect domain → Verify, not internal provider phases. - Every completion message must state what is now working and then offer exactly one
[rekomendasi]next step. - Technical users can ask for "technical details",
--technical, JSON, or provider-specific skills. Do not force those details on everyone else. - When a planner/tool returns
userPlan, that is the default user-facing response. Fields such as route, providerRouting, executionEngine, credential key names, and raw flow ids are internal/advanced unless they are necessary to recover from an error.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -9 lines 36a6ebaf1847
- 1mo ago Changed · +43 lines · +9 tokens per session 084ca24b38de
- 1mo ago Changed · +82 lines · -65 tokens per session c628d59cd8ae
- 1mo ago First seen · 231 lines · 122 tokens per session scan A ae43d0c02527
sc-all is a skill published in the GitHub repository rahmanef63/si-coder-agent (13 stars, last pushed 3d ago), licensed MIT. It adds 66 tokens to every session and 3,740 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
modal
Modal is a serverless cloud platform for running Python on demand, including on-demand GPUs. Use when deploying or serving AI/ML models, running GPU-accelerated workloads (training, fine-tuning, inference), serving web endpoints, scheduling batch jobs, or scaling Python code to cloud containers with the Modal SDK.
latchbio-integration
Builds, registers, debugs, and operates bioinformatics workflows on Latch using the Python SDK, CLI, Latch Data and Registry, Nextflow, Snakemake, programmatic execution, and Latch MCP. Use when authoring or deploying Latch workflows, configuring resources or interfaces, moving data, integrating Registry, or launching…
django-storages-s3
Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST…
terraform-engineer
Use when implementing infrastructure as code with Terraform across AWS, Azure, or GCP. Invoke for module development (create reusable modules, manage module versioning), state management (migrate backends, import existing resources, resolve state conflicts), provider configuration, multi-environment workflows, and…
websocket-engineer
Use when building real-time communication systems with WebSockets or Socket.IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.
add-vercel
Add Vercel deployment capability to NanoClaw agents. Installs the Vercel CLI in agent containers and sets up OneCLI credential injection for api.vercel.com. Use when the user wants agents to deploy web applications to Vercel.