Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add silo-code/silo --skill silo-extension-buildergit clone --depth 1 https://github.com/silo-code/siloWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/silo-code/silo/silo-extension-builder)<a href="https://agentmods.dev/skills/silo-code/silo/silo-extension-builder"><img src="https://agentmods.dev/badge/skills/silo-code/silo/silo-extension-builder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/silo-code/silo/silo-extension-builder"><img src="https://agentmods.dev/badge/skills/silo-code/silo/silo-extension-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 52 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 58 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02386 |
| Opus 5.5 | $0.00021 | $0.00954 |
| Sonnet 5.5 | $0.00011 | $0.00477 |
| Haiku 4.5 | $0.00005 | $0.00239 |
Grade A, and why
silo-extension-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 306 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Extension Builder
Turn a natural-language description into a working Silo extension. The extension
is real, publishable TypeScript — not a prototype or a hack. silo install drops
it into Silo immediately; silo uninstall removes it cleanly.
Arguments
The skill accepts two optional arguments: id and path.
id— the extension id (e.g.dave.clock). If not provided, ask the user.path— the directory to create the extension in. If not provided, default to/tmp/silo-ext/<id>and confirm with the user.
Parse arguments from the invocation line. Examples:
/silo-extension-builder id=dave.clock— id given, use default path/silo-extension-builder path=~/projects/my-ext— path given, ask for id/silo-extension-builder id=dave.clock path=~/projects/my-ext— both given, skip both questions/silo-extension-builder— neither given, ask for both before proceeding
Workflow (always in this order)
- Resolve args — extract
idandpathfrom the invocation; ask the user for any that are missing - Scaffold — run
npx create-silo-extensionto create the directory structure and manifest - Plan — identify which
ctx.*APIs the extension needs (see API Reference below) - Write the implementation to
<path>/src/index.tsx(overwrites the scaffold placeholder) - Compile with esbuild (output to
<path>/dist/index.js) - Ask — show the user the compiled output path and ask if they want to install it now
- Install (only if the user says yes) via
silo install <path> - Tell the user what to look for in Silo
Choosing an extension id
If the user didn't supply one, ask before writing any files. Pick a namespaced id
that reflects what the extension does: dave.clock, dave.tasks,
dave.git-branch, etc. The user's name or handle makes a natural namespace.
Step 2 — Scaffold
Run create-silo-extension with all known args to avoid interactive prompts.
Prefer the local build when inside the Silo repo; fall back to npx otherwise:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 306 lines · 53 tokens per session scan A c3943815d94f
silo-extension-builder is a skill published in the GitHub repository silo-code/silo (62 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 2,386 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
supersplat
Use when editing 3D Gaussian Splatting (3DGS) .ply models in browser — cleanup noise/floaters, crop, transform, color-adjust, animate camera, publish online. SuperSplat: open-source browser-based 3DGS editor by PlayCanvas with PLY/compressed PLY/Splat/SOG/SPZ export.
pi
Use when needing a minimal, extensible terminal AI coding agent harness in TypeScript with plugin architecture. Pi: minimalist terminal AI coding agent emphasizing simplicity and composability.
agenthub-typescript
Guidance for using the AgentHub TypeScript SDK (@prismshadow/agenthub). Use when developing agents that call different LLM APIs, need a unified interface for LLM providers, mention AgentHub, request @prismshadow/agenthub, or already import it.
npm-package
Opinionated TypeScript npm package template for ESM packages. Enforces src→dist builds with tsc, strict TypeScript defaults, explicit exports, and publish-safe package metadata. Relative source imports must use .ts or .tsx (never .js); tsc rewrites them via rewriteRelativeImportExtensions. Use this when creating or…
angular-expert
Expert knowledge in Angular framework, RxJS reactive programming, TypeScript, dependency injection, and enterprise application development. Use when the user mentions RxJS, TypeScript, dependency injection, reactive, frontend, or enterprise, or when the task involves Angular Fundamentals, RxJS Integration, Advanced…
sinch-functions-node
Write Node.js/TypeScript Sinch Functions with @sinch/functions-runtime. Use when writing or editing function.ts: answering and controlling calls with Voice API v2, IVR menus, placing or bridging calls, SMS/WhatsApp/RCS webhooks, custom HTTP endpoints, cache/storage/database, auth and setup() hooks. Run and deploy with…