Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sd0xdev/sd0x-harness/portfolionpx skills add sd0xdev/sd0x-harness --skill portfoliogit clone --depth 1 https://github.com/sd0xdev/sd0x-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sd0xdev/sd0x-harness/portfolio)<a href="https://agentmods.dev/skills/sd0xdev/sd0x-harness/portfolio"><img src="https://agentmods.dev/badge/skills/sd0xdev/sd0x-harness/portfolio.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00049 | $0.00640 |
| Opus 5 | $0.00024 | $0.00320 |
| Sonnet 5 | $0.00010 | $0.00128 |
| Haiku 4.5 | $0.00005 | $0.00064 |
Grade B, and why
portfolio scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST /positions -d '{"isForceRefresh": true, ...}' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST /positions -d '{"isForceRefresh": true, ...}' How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Portfolio Skill
Trigger
- Keywords: Portfolio, portfolio, position, {PRIMARY_PROVIDER}, protocol, lending, staking, liquidity
When NOT to Use
- General token queries (not Portfolio positions)
- Transaction building (use corresponding provider)
- Non-portfolio related API issues
Core Files
| Type | File | Purpose |
|---|---|---|
| Controller | src/entity/portfolio/portfolio.controller.ts |
REST API |
| Router | src/service/portfolio/source-router/*.service.ts |
Routing orchestration |
| Client | src/service/portfolio/providers/{provider}/*.ts |
{PRIMARY_PROVIDER} integration |
| Aggregator | src/service/portfolio/aggregation/*.service.ts |
Aggregation computation |
| DTO | src/dto/portfolio/position.types.ts |
Position model |
API Overview
Base: /onchain/v1/portfolio
| Endpoint | Method | Purpose |
|---|---|---|
/positions |
POST | Get portfolio positions |
/chains |
GET | Supported chains list |
/protocols |
GET | Supported protocols list |
Output
- Domain-specific query results with code references
- Analysis and recommendations based on current architecture
Verification
- Position data correctly normalized
- Cache hit/miss working properly
- Aggregation calculations accurate
Development Guide
Add Protocol Support
- Check if {PRIMARY_PROVIDER} supports it
- If custom build needed: implement
PortfolioPositionExtractor+ register + configure routing
Add Data Source
- Implement
ProviderClient+Adapter - Register with
SourceRouter - Configure routing strategy
Debug
redis-cli keys "portfolio:{provider}:*"
redis-cli get "portfolio:{provider}:positions:0x...:v2:..."
curl -X POST /positions -d '{"isForceRefresh": true, ...}'
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 97 lines · 49 tokens per session scan B 6dd47434e794
portfolio is a skill published in the GitHub repository sd0xdev/sd0x-harness (188 stars, last pushed yesterday), licensed MIT. It adds 49 tokens to every session and 640 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
yield-xyz-agentkit-builder
Build applications that integrate with the Yield.xyz APIs — staking, lending, vaults, and RWA across 80+ networks. Generates code covering REST API integration, transaction signing, wallet connection, and fee monetization. Use when user wants to build an app, integrate yield, generate code, or set up a project using…
yield-xyz-agentkit-privy
The Privy connector for the Yield.xyz AgentKit — signs and broadcasts via Privy agentic wallets. Extends the yield-xyz-agentkit skill — that skill discovers yields and builds the unsigned transactions; this one adds Privy wallet creation, policy enforcement, signing, and broadcasting, in autonomous and semi-autonomous…
yield-xyz-agentkit-moonpay
The MoonPay connector for the Yield.xyz AgentKit — signs and broadcasts via MoonPay. Extends the yield-xyz-agentkit skill — that skill discovers yields and builds the unsigned transactions; this one adds MoonPay wallet auth, signing, and broadcasting. Use when the user wants to enter, exit, or manage yield positions…
yield-xyz-agentkit
Discover and act on 2,900+ DeFi yield opportunities via Yield.xyz AgentKit Skills, find yields, check APY enter/exit positions, and manage rewards across 80+ networks.
hyperliquid-reader
Read Hyperliquid (app.hyperliquid.xyz) perp + spot market data via opencli (read-only, public info API). Use whenever the user wants Hyperliquid perpetual or spot markets, mark/oracle/mid prices, 24h change, funding rates (hourly or annualized APR), open interest, volume, the L2 order book, OHLCV candles, historical…
grayscale-crypto-sectors
Use when evaluating crypto through a Grayscale-style Crypto Sectors lens: sector taxonomy, FTSE/Grayscale index eligibility, fee/usage fundamentals, sector-share valuation, ETP/trust wrappers, and Zcash-style privacy-as-money theses.