Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ruali-dev/riven-analyst/setupnpx skills add ruali-dev/Riven-Analyst --skill setupgit clone --depth 1 https://github.com/ruali-dev/Riven-AnalystWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.00590 |
| Opus 5 | $0.00019 | $0.00295 |
| Sonnet 5 | $0.00008 | $0.00118 |
| Haiku 4.5 | $0.00004 | $0.00059 |
Grade A, and why
setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Riven Analyst Setup
Finish setup with one configuration decision and one permission confirmation. Never ask the player to paste an API key into chat or write one into a repository file.
Workflow
- Identify the host, then confirm the install scope. Use
userfor all projects,localfor this player on the current project, andprojectonly when the repository should share the plugin configuration. - Configure the external OpenAI-compatible vision endpoint, model, Provider label, and API key.
- On Claude Code, use Claude's native Riven Analyst plugin configuration dialog or the bundled
mcp-server/vision-config.htmlhelper. On Codex, use the host's MCP environment configuration for the documentedRIVEN_VISION_*variables. Do not collect the key in prose. The current Claude project directory is the image root for the MCP vision adapter. For a screenshot elsewhere, let the host read that one folder temporarily or copy the screenshot into the project; do not create a persistent plugin directory setting or request a whole-drive grant. - Choose whether bounded web research is enabled. Explain that it is used only when the trusted local sample does not answer the current identity or recommendation question.
- On Claude Code, preview the permission update with
scripts/configure_permissions.py --dry-run. Show the target settings file and added rules, then ask for one confirmation. The narrowly scoped rules cover the Riven MCP tools, read-only access to this installed plugin's bundled references, and the selected web policy. After confirmation run the same command with--apply. Codex plugin MCP permissions do not use this Claude settings script. - Ask Claude Code to
/reload-plugins, or start a new Codex task, after configuration changes. Report the chosen modes and permission scope without printing secrets.
Permission command
Run the bundled script with the selected values:
uv run --project "${CLAUDE_PLUGIN_ROOT}" --locked --no-dev python "${CLAUDE_PLUGIN_ROOT}/skills/setup/scripts/configure_permissions.py" --scope <user|local|project> --web-research <enabled|disabled> --dry-run
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 46 lines · 38 tokens per session scan A 76cd3a8c86f1
setup is a skill published in the GitHub repository ruali-dev/Riven-Analyst (3 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 38 tokens to every session and 590 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
create-skill
Wizard for creating new Agent Zero skills. Guides users through creating well-structured SKILL.md files. Use when users want to create custom skills.
battle-tested-engineer
Engineering judgment for code write/refactor/test and frontend UI. Trigger on code review, legacy cleanup, tests, UI with data, bloat/over-engineer complaints — even with no explicit mention, before any diff/rewrite/test suite. Output ultra-terse caveman style; code, commits, PR desc, security warnings stay normal…
capabilities-manager
Manage capa CLI configuration — capabilities.yaml / capabilities.json, skills, MCP servers, tools, hooks, sub-agents, rules, plugins, AGENTS.md / CLAUDE.md, security options, tool exposure modes, capa wrap shadow workspaces, --passthrough native writes, registries (including Claude marketplaces), activity traces, and…
fw-ai-actions-app
Expert-level skill for AI Actions and integrations on Freshworks Platform 3.0. Use when (1) Creating actions.json and SMI functions (flat request, nested response), (2) Request templates and third-party API integration, (3) Pre-build validation (pricing, paywalls, account prerequisites), (4) Failure-case validation…
fw-review
Full Freshworks marketplace app review — iparams, frontend, serverless, FDK, security, and structured text report output — in one skill.
daily-meeting-update
Summarize recent development activity.