Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sgaunet/claude-plugins --skill gum-beautifygit clone --depth 1 https://github.com/sgaunet/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sgaunet/claude-plugins/gum-beautify)<a href="https://agentmods.dev/skills/sgaunet/claude-plugins/gum-beautify"><img src="https://agentmods.dev/badge/skills/sgaunet/claude-plugins/gum-beautify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sgaunet/claude-plugins/gum-beautify"><img src="https://agentmods.dev/badge/skills/sgaunet/claude-plugins/gum-beautify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 133 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 34 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 133 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 133 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03437 |
| Opus 5 | $0.00000 | $0.01718 |
| Sonnet 5 | $0.00000 | $0.00687 |
| Haiku 4.5 | $0.00000 | $0.00344 |
Grade A, and why
gum-beautify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
run_with_spinner "Downloading artifacts..." curl -sL "$url" -o "$output" How it starts
The opening of the file, as written. The whole thing — 418 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Gum Terminal UX Integration
Integrate Charmbracelet's gum CLI tool into bash scripts for beautiful terminal output, interactive prompts, and structured logging -- with mandatory TTY detection to ensure scripts remain pipe-safe.
When to Use
- User requests interactive prompts (selection menus, confirmations, text input)
- Script needs visually styled output (headers, banners, success/error messages)
- Structured logging is needed (
gum logwith levels and key-value pairs) - Progress indication for long-running operations (spinners)
- User wants a polished CLI experience for their bash tools
- Existing scripts need UX improvements without changing functionality
Prerequisites
- gum is installed: The script must verify gum is available at runtime. This skill provides the detection boilerplate but does NOT handle gum installation -- the script should fail with a clear message directing the user to install gum.
- Bash 3.2+: Gum integration patterns use bash-specific features (
[[ ]]tests, process substitution). None of these patterns need bash-4-only features (associative arrays,mapfile), so they run on macOS's default/bin/bash3.2.
Gum Subcommand Reference
| Subcommand | Purpose | Needs TTY stdin | Output |
|---|---|---|---|
gum input |
Single-line text input | Yes | stdout |
gum write |
Multi-line text editor | Yes | stdout |
gum filter |
Fuzzy filter from list | Yes | stdout |
gum choose |
Select from options | Yes | stdout |
gum confirm |
Yes/no confirmation | Yes | exit code |
gum file |
File picker | Yes | stdout |
gum pager |
Scrollable text viewer | Yes | none |
gum spin |
Spinner during command | No | passthrough |
gum table |
Interactive row picker; formatted display with --print |
Yes (No with --print) |
stdout |
gum style |
Styled text block | No | stdout |
gum format |
Markdown/emoji rendering | No | stdout |
gum log |
Structured log messages | No | stderr |
gum join |
Join styled blocks | No | stdout |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 418 lines · 0 tokens per session scan A 55ddd4de02a1
gum-beautify is a skill published in the GitHub repository sgaunet/claude-plugins (16 stars, last pushed 7d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,437 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-pr
Review a Pull Request in one of two postures: an expository "tour guide" that walks through changes in logical order, or an adversarial audit that assumes the change is wrong until proven safe and hunts for the failure mode. Triggers: "review PR #123", "adversarial review", "walk me through this PR", "PR tour guide"…
researcher
Use when asked to create research documents, generate PDFs, make one-pagers, or create cheatsheets. Triggers: "research document", "generate PDF", "one-pager", "cheatsheet", "distinctive design". Provides HTML/Markdown/PDF with Terminal, Editorial, Corporate, Industrial, Fresh aesthetic presets.
generate-doc-template
Generates on-brand document and deck templates — letterhead, slide, and one-pager — as SVG from the active brand profile, with editable title, subtitle, and body zones. Vector output needs no account, key, or network. Use when a user asks for a letterhead, a slide or deck master, or a branded one-pager. Trigger with…
generate-graphic
Generates an on-brand marketing graphic — hero image, ad creative, background, or texture — with an image model, optionally stamped with the brand logo and a caption. Opt-in: needs a provider key and network access. Use when a user wants a photographic or illustrative graphic, not a text-heavy asset. Trigger with…
generate-logo
Generates on-brand, editable SVG logo assets — wordmark, monogram, and favicon — from the active brand profile, reusing its exact palette and heading font. Vector output needs no account, key, or network. Use when a user asks for a logo, wordmark, icon, monogram, or favicon. Trigger with "make a logo", "generate a…
generate-social
Generates platform-sized, on-brand social templates as SVG from the active brand profile, with editable headline, subhead, and call-to-action zones. Vector output needs no account, key, or network. Use when a user asks for an Instagram post or story, an Open Graph or social card, a YouTube thumbnail, or a banner.…