Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/robertguss/claude-code-toolkit/paywall-pricing-optimizernpx skills add robertguss/claude-code-toolkit --skill paywall-pricing-optimizergit clone --depth 1 https://github.com/robertguss/claude-code-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/robertguss/claude-code-toolkit/paywall-pricing-optimizer)<a href="https://agentmods.dev/skills/robertguss/claude-code-toolkit/paywall-pricing-optimizer"><img src="https://agentmods.dev/badge/skills/robertguss/claude-code-toolkit/paywall-pricing-optimizer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00143 | $0.03563 |
| Opus 5 | $0.00072 | $0.01782 |
| Sonnet 5 | $0.00029 | $0.00713 |
| Haiku 4.5 | $0.00014 | $0.00356 |
Grade A, and why
paywall-pricing-optimizer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 393 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prerequisites
- A defined app concept (what it does, who it serves)
- Target platform (iOS, Android, or both)
- Revenue goal (hobby $1K/mo vs business $10K/mo)
- No tools required — this skill produces strategy and implementation guidance
Workflow Overview
1. Assess the App
2. Choose Monetization Model
3. Design Subscription Tiers
4. Set Pricing
5. Design the Paywall Screen
6. Plan Pricing Experiments
Step 1: Assess the App
Gather these inputs before making any monetization decisions:
Questions to ask:
- What core value does the app provide? (entertainment, productivity, health, utility)
- How often do users engage? (daily, weekly, occasionally)
- Who is the target audience? (age, income, tech savviness)
- What do competitors charge? (research 3-5 direct competitors)
- Does the app have ongoing costs? (AI API calls, server infrastructure, content creation)
Usage frequency determines model viability:
| Frequency | Best Models | Why |
|---|---|---|
| Daily | Subscription | High engagement justifies recurring cost |
| 2-3x per week | Subscription or freemium | Moderate engagement, needs strong value |
| Weekly or less | One-time purchase or consumable | Hard to justify subscription |
| Sporadic/urgent | One-time purchase or pay-per-use | Users pay when they need it |
Step 2: Choose Monetization Model
Decision Framework
Does the app provide ongoing, evolving value?
├── YES → Does it have significant per-use costs (AI, API)?
│ ├── YES → Freemium with consumables (credits/tokens)
│ └── NO → Subscription
└── NO → Is it a tool with finite, clear value?
├── YES → One-time purchase (or lifetime unlock)
└── NO → Freemium with ads + optional ad removal
Model Deep-Dive
Subscription (~70% of top-grossing apps)
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 393 lines · 143 tokens per session scan A 4542de84ad9f
paywall-pricing-optimizer is a skill published in the GitHub repository robertguss/claude-code-toolkit (108 stars, last pushed 27d ago), licensed MIT. It adds 143 tokens to every session and 3,563 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
offensive-tls-attacks
Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers…
offensive-mobile
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component…
offensive-business-logic
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows…
offensive-jwt
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing…
fluentcart-rest-headless
Implements and audits FluentCart REST, AJAX, headless, mobile, and external client integrations. Covers the source-verified /fluent-cart/v2 routes, FluentCart router policies, WordPress cookie/nonces and application passwords, customer ownership, public checkout endpoints, cart-hash trust, custom registerrestroute…
developer-device-platform-basics
Provides guidance and instructions on managing remote devices on Developer Device Platform (DDP). Use when reserving remote Android devices, establishing connection tunnels, checking session status, or extending/cancelling leases. Don't use for iOS or local device/hardware inquiries.