Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sinch/skills --skill sinch-10dlcgit clone --depth 1 https://github.com/sinch/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sinch/skills/sinch-10dlc)<a href="https://agentmods.dev/skills/sinch/skills/sinch-10dlc"><img src="https://agentmods.dev/badge/skills/sinch/skills/sinch-10dlc/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sinch/skills/sinch-10dlc"><img src="https://agentmods.dev/badge/skills/sinch/skills/sinch-10dlc.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 154 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Data Exfiltration · line 90 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.03384 |
| Opus 5 | $0.00049 | $0.01692 |
| Sonnet 5 | $0.00020 | $0.00677 |
| Haiku 4.5 | $0.00010 | $0.00338 |
Grade A, and why
sinch-10dlc scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
4. **Language** — any language, or curl. This API is REST-only; there is no SDK wrapper. Use curl, `fetch`, `axios`, `requests`, or equivalent HTTP clients. Copies of this mod
1 near-identical copy found in the catalogue:
- sinch-10dlc — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sinch 10DLC Registration
Overview
10DLC (10-Digit Long Code) is the required US registration system for Application-to-Person (A2P) SMS on standard 10-digit phone numbers. You must register a brand (the sending company) and a campaign (the messaging use case) with The Campaign Registry (TCR) via Sinch before sending any US A2P SMS.
Agent Instructions
Before generating code, gather from the user (skip any item already specified in the prompt or context):
- Goal — register a brand, register a campaign, check status, or troubleshoot a rejection?
- Brand ID? — if the user already has one, skip to Step 3 (qualify) or Step 4 (campaign).
- Registration type —
SIMPLIFIED(faster, lower throughput, $10) orFULL(recommended for production, $50)? - Language — any language, or curl. This API is REST-only; there is no SDK wrapper. Use curl,
fetch,axios,requests, or equivalent HTTP clients.
This skill covers 10DLC only. The same Registration API also includes TFN (Toll-Free Number) verification endpoints — for toll-free registration, see the API spec directly.
Refer to the API reference linked in Links for request/response schemas.
Security: See the Security section below for url fetching policy and credential handling.
Source of Truth — what to load, and what is authoritative
This skill has two kinds of content with UNEQUAL reliability. Follow this precedence:
- Canonical docs at
developers.sinch.com(AUTHORITATIVE). The.mddoc links in this skill are the single source of truth for exact request/response schemas, field names and nesting, enum values, signature/auth schemes, and limits. Before writing code that constructs a payload, verifies a signature, or parses a callback/response, fetch the specific linked doc and confirm the exact shape there. Fetching first-partydevelopers.sinch.comURLs is permitted by the Security/URL policy. Never invent, guess, or pattern-extrapolate a documentation URL — only fetch doc URLs written verbatim in this skill or reached by following a link on a page you already fetched; a trusted domain does not make a guessed path real. - Bundled
references/*.md(NAVIGATIONAL SUMMARIES — not authoritative). They orient you and point at the right canonical doc; they may lag, omit fields, or simplify nesting. Use them to decide what to build and which doc to open. Do NOT transcribe a field name, nesting, encoding, or enum from a reference or from the SKILL.md overview into shipped code without confirming it in the tier-1 doc. If a detail appears only in a summary, treat it as unverified and say so.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 203 lines · 98 tokens per session scan A e0b97e88994e
sinch-10dlc is a skill published in the GitHub repository sinch/skills (9 stars, last pushed 13d ago), licensed Apache-2.0. It adds 98 tokens to every session and 3,384 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
procurement-audit
A procurement review workflow that checks contracts and purchase documents against uploaded purchasing rules. It links each finding to the relevant rule and supporting text.
travel-expense-audit
A travel-expense review workflow that checks reimbursement claims against policy handbooks and rate tables. It covers items such as hotel, transport, and daily meal allowances.
compliance-frameworks
Swiss financial regulatory compliance — FINMA, GwG/AML/KYC, FIDLEG/FINIG licensing, BankG, crypto/DLT regulation, cross-border obligations (AEOI/CRS, FATCA). Trigger when: user asks about FINMA licensing, AML/KYC compliance, financial services cross-border, crypto regulation, or fintech data processing. Do NOT trigger…
data-protection-law
Swiss data protection — nDSG/FADP framework, GDPR adequacy, cantonal DP laws (IDG/KDSG/LIPAD), DSFA/DPIA, cross-border transfers. Trigger when: user asks about nDSG/GDPR compliance, DPAs, data transfers, DPIA, data subject rights, or references FDPIC/nDSG/FADP. Do NOT trigger for: fintech regulatory compliance (use…
swiss-legal-research
Swiss legal research and jurisdiction resolution — searches BGE/ATF/DTF precedents, interprets federal and cantonal statutes, resolves federal vs. cantonal jurisdiction, and produces verified multi-lingual legal analysis. Trigger when: a user asks what the law says, requests precedents, needs statute interpretation…
adversarial-analysis
Adversarial stress test — three agents (Advocate FOR, Adversary AGAINST, Judicial synthesis with probability). Trigger when: user wants to stress-test a position, check weaknesses before filing, or requests adversarial review. Also option '4' in /legal menu. Do NOT trigger for: initial research (swiss-legal-research)…