Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sanity-io/agent-toolkit --skill sanity-migrationgit clone --depth 1 https://github.com/sanity-io/agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sanity-io/agent-toolkit/sanity-migration)<a href="https://agentmods.dev/skills/sanity-io/agent-toolkit/sanity-migration"><img src="https://agentmods.dev/badge/skills/sanity-io/agent-toolkit/sanity-migration.svg" alt="Measured on agentmods" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
- medium MCP Rug Pull · line 59 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01152 |
| Opus 5 | $0.00051 | $0.00576 |
| Sonnet 5 | $0.00020 | $0.00230 |
| Haiku 4.5 | $0.00010 | $0.00115 |
Grade A, and why
sanity-migration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sanity Migration
Use this skill for CMS-to-Sanity migration work. Treat migration as a content strategy and ETL project, not a blind lift-and-shift.
Required Workflow
- Read
references/general.mdfirst. - If the source platform is known, also read its guide:
- AEM / Adobe Experience Manager:
references/aem.md - Contentful:
references/contentful.md - Strapi:
references/strapi.md - Webflow:
references/webflow.md - WordPress / WXR / Elementor:
references/wordpress.md - Payload:
references/payload.md - Drupal:
references/drupal.md - Markdown / MDX / frontmatter files:
references/markdown.md
- AEM / Adobe Experience Manager:
- Before writing code, produce a short migration plan covering source access, content scope, schema decisions, extraction, transformation, import, validation, redirects, and cutover.
- Prefer deterministic, repeatable scripts for real migrations. Write and review migration scripts, mappings, and validation checks; do not rely on one-off content operations for large content volumes.
Deliverables to Produce
For implementation or planning tasks, produce these artifacts or explain why they are not needed:
- Content inventory: source types, counts, locales, status/draft scope, assets, and relationship types.
- Source-to-Sanity mapping: document types, object types, references, Portable Text fields, asset fields, IDs, and skipped content.
- Extraction approach: credentials/access needed, API/export commands, raw snapshot location, and known blind spots.
- Transform/import plan: deterministic IDs, write order, asset handling, rich text conversion, validation, and rerun strategy.
- Cutover plan: delta sync/content freeze, redirects, broken-link checks, SEO metadata, and manual cleanup.
Defaults
- Use stable document IDs derived from source IDs, slugs, paths, or hashes.
- Use
createOrReplace,createIfNotExists, orsanity datasets import --replaceso reruns converge. - Snapshot extracted source data to disk before transforming it.
- Import or create referenced documents before documents that reference them.
- Convert rich text to Portable Text instead of storing raw HTML or Markdown strings.
- Upload assets to Sanity or the Media Library; do not leave production content dependent on legacy CDN URLs.
- Track per-document quality issues and produce a validation summary before cutover.
- Preserve legacy URLs and source IDs for redirects, QA, and future debugging.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 90 lines · 102 tokens per session scan A 148ef2e394c2
sanity-migration is a skill published in the GitHub repository sanity-io/agent-toolkit (181 stars, last pushed 2d ago), licensed MIT. It adds 102 tokens to every session and 1,152 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-lifecycle
Provides API design and lifecycle management guidance including versioning, deprecation, rate limiting, and documentation standards. Triggers on api design, rest api, graphql, api versioning, deprecation, breaking changes, rate limiting, api lifecycle, api documentation, openapi.
webhooks
Webhook subscriptions for the Ayrshare MCP server: register, unregister, and list HTTPS push notifications so an agent or app is notified on events instead of polling. Use whenever someone wants event push: "notify me when a post publishes", "let me know when a scheduled post goes out", "set up a webhook for new…
n8n-subworkflows
Build reusable, composable n8n sub-workflows. Use when extracting shared logic, building anything multi-step or reused across workflows, or any workflow over 10 nodes — and whenever the user mentions sub-workflows, Execute Workflow, reuse, shared/common logic, modular workflows, "Define Below" inputs…
add-cloud-flow
Integrates Power Automate cloud flows into a Power Pages site. Lists available flows, suggests relevant ones based on intent, identifies scenarios and web roles, creates metadata files, and generates client-side code to call flows. Handles both new flow registration and adding already-registered flows to additional…
tidewave-integration
Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.
api-testing
HTTP API testing for TypeScript (Supertest) and Python (httpx, pytest). Test REST APIs, GraphQL, request/response validation, authentication, and error handling.