Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rianvdm/product-ai-public --skill auditing-cd-collectiongit clone --depth 1 https://github.com/rianvdm/product-ai-publicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rianvdm/product-ai-public/auditing-cd-collection)<a href="https://agentmods.dev/skills/rianvdm/product-ai-public/auditing-cd-collection"><img src="https://agentmods.dev/badge/skills/rianvdm/product-ai-public/auditing-cd-collection/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rianvdm/product-ai-public/auditing-cd-collection"><img src="https://agentmods.dev/badge/skills/rianvdm/product-ai-public/auditing-cd-collection.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 22 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 22 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Data Exfiltration · line 60 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.03001 |
| Opus 5 | $0.00053 | $0.01501 |
| Sonnet 5 | $0.00021 | $0.00600 |
| Haiku 4.5 | $0.00011 | $0.00300 |
Grade A, and why
auditing-cd-collection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auditing the CD collection for remasters
Overview
Classifies every CD in Rian's Discogs collection as remaster / original / unverified, finds a non-remastered pressing to replace each remaster with, and writes it all to a Google Sheet he can work through. Core insight: the whole thing runs off two Discogs endpoints plus one versions lookup, and the expensive part (~1,800 API calls) is fully cached on disk — so a re-run after a wantlist change costs one script, not the whole pipeline.
Last full run: 2026-08-05 — 780 CDs, 171 flagged, 135 on the review list after exclusions. Output: a Google Sheet, plus a human-readable writeup alongside it.
When to use
- "Which of my CDs are remasters?" · "audit my collection" · "re-run the CD audit"
- After adding replacements to the wantlist and wanting the review list refreshed
- Not for: one album (
finding-original-cds), pricing a wantlist (finding-cd-bundles), vinyl (the folder ID would need changing)
Running it
Scripts live beside this file. They read and write a working directory set by AUDIT_DIR — never let data land in the skill folder. DISCOGS_TOKEN is in ~/git/product-ai/.env (also ~/.config/ebay/credentials.env).
export AUDIT_DIR=/path/to/scratchpad
set -a; . ~/git/product-ai/.env; set +a # DISCOGS_TOKEN
S=~/git/product-ai/.opencode/skills/auditing-cd-collection
python3 $S/fetch_collection.py # ~10s collection + wantlist
python3 $S/fetch_details.py # ~35min 780 releases + 737 masters (RESUMABLE)
python3 $S/classify.py # instant, local only
python3 $S/enrich.py # ~8min versions lookup for ~250 masters (RESUMABLE)
python3 $S/build_sheet.py # ~1min creates the spreadsheet
python3 $S/format_sheet.py # ~30s reads sheet.json written by the previous step
Order matters and the steps are not independent. classify.py must run before enrich.py (enrich reads classified.json to decide which masters to look up), and build_sheet.py writes the sheet.json that format_sheet.py needs.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 133 lines · 106 tokens per session scan A 52b42b7b9c7b
auditing-cd-collection is a skill published in the GitHub repository rianvdm/product-ai-public (16 stars, last pushed 2d ago), licensed MIT. It adds 106 tokens to every session and 3,001 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webgl-holographic-foil
A self-contained WebGL2 hero: thin-film interference over a crushed-foil surface whose palette shifts with the viewing angle; move the cursor to tilt the film.
general-video
Author or edit a custom HyperFrames composition when no specialized workflow fits, or when BRIEF.md sets flow: companion. Use for longer or multi-scene pieces, brand and sizzle reels, montages, static loops, static title cards, footage remixes, and freeform builds. Use motion-graphics instead for a short unnarrated…
html-ppt-hermes-cyber-terminal
OpenDesign + BYOK: choosing and wiring your own model, hands-on — cost, quality, and the routing decision. Built as a decision-grade AI literacy deck for engineers, IT, applied-AI teams.
html-ppt-taste-brutalist
16:9 HTML deck in tactical-telemetry / CRT-terminal taste. Deactivated-CRT charcoal slides, white-phosphor monospace, hazard-red accent, scanline overlay, ASCII syntax, density over decoration. Distilled from Leonxlnx/taste-skill brutalist-skill (Tactical Telemetry mode).
chengfeng-check-updates
An environment manager for a video-editing system. It checks whether its skills and runtime—the software needed to run them—are installed and compatible.
diagnostic-stem-delivery
Audio production with diagnostic analysis, timecode parsing from documents, and verified export workflow.