Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Singtaa/OneJSnpx agentmods add skills/singtaa/onejs/onejs-setup-and-overviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/singtaa/onejs/onejs-setup-and-overview)<a href="https://agentmods.dev/skills/singtaa/onejs/onejs-setup-and-overview"><img src="https://agentmods.dev/badge/skills/singtaa/onejs/onejs-setup-and-overview/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/singtaa/onejs/onejs-setup-and-overview"><img src="https://agentmods.dev/badge/skills/singtaa/onejs/onejs-setup-and-overview.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 162 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 288 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00211 | $0.07455 |
| Opus 5.5 | $0.00084 | $0.02982 |
| Sonnet 5.5 | $0.00042 | $0.01491 |
| Haiku 4.5 | $0.00021 | $0.00745 |
Grade A, and why
onejs-setup-and-overview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 435 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Set Up a OneJS Project
OneJS runs React 19 and TypeScript user interfaces inside Unity. TSX source compiles with esbuild into a single bundle that the JSRunner component executes through QuickJS, or through the browser's own JavaScript engine on WebGL, and renders through UI Toolkit. There is no DOM and no webview. This skill takes a project from "OneJS is installed" to "a React component is rendering in the Game view and hot reloading on save", and lists the small number of mistakes that account for most blank panels.
When to use this skill
- "set up OneJS in this project", "get OneJS running", "initialize a OneJS app"
- "add a main menu", "build a settings screen", "make a HUD", "add an inventory panel", in a project that has OneJS installed
- "write this UI in React instead of C#", "use TypeScript for my Unity UI"
- "my OneJS panel is blank", "nothing renders in the Game view", "hot reload stopped working"
- "where does the UI code live", "why is there a folder with a tilde in it"
- "run this ojplay cart in Unity", "I cloned a cart next to Assets", "the runner says No Cart"
Not for:
- Per-component props and API detail. Read https://onejs.com/docs instead.
- Projects without OneJS installed. Run the Prerequisites check first; if it fails, say so rather than writing OneJS code that cannot compile.
- uGUI (
Canvas,UnityEngine.UI) or IMGUI (OnGUI) work. OneJS renders through UI Toolkit only.
Prerequisites
- Unity 6000.3 or newer.
- Node.js 18 or newer on the development machine, on
PATH. OneJS shells out tonpmfor install and build. - No other Unity packages and no scoped registries are required.
Install check. Confirm the type OneJS.JSRunner resolves. Any one of these is sufficient:
// In an editor script or an eval tool
var t = System.Type.GetType("OneJS.JSRunner, OneJS.Runtime");
UnityEngine.Debug.Log(t != null ? "OneJS installed" : "OneJS NOT installed");
Or confirm on disk that one of these paths exists: Assets/Singtaa/OneJS/ (Asset Store), Assets/OneJS/ (git clone), or Packages/com.singtaa.onejs/ (Package Manager).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 8f85758d7075
- 4d ago Changed dc7bf883d64f
- 7d ago Changed · +34 lines · +12 tokens per session 34ba1c1b35d4
- 10d ago Changed 8bb2366e4e44
- 11d ago Changed 4bed5c7d88dc
- 12d ago Changed e215adb32134
- 15d ago Changed 80bc99af627c
- 19d ago Changed db127346789d
- 20d ago Changed · -3 lines 5d7d4c370bbf
- 21d ago First seen · 404 lines · 199 tokens per session scan A 81c254dde7ed
onejs-setup-and-overview is a skill published in the GitHub repository Singtaa/OneJS (362 stars, last pushed yesterday), licensed MIT. It adds 211 tokens to every session and 7,455 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
psl-ast-layers
How to use the PSL syntax tree layers (green tree, red tree, strongly-typed AST classes) correctly. Use for any PSL-related work: PSL interpreters (contract-psl), helpers inside the psl-parser package, the language server, formatters, or anything else that consumes parse() output from @internal/psl-parser.
compiler-orchestrator
Orchestrate the Rust compiler port end-to-end. Discovers the current frontier, fixes failing passes, ports new passes, reviews, and commits in a loop.
ast-visitor-pattern
Use the frozen-class/visitor pattern for discriminated unions that have multiple dispatch sites. Use when creating a new set of variants (commands, IR nodes, factory calls) that will be switched over in 2+ places, or when refactoring an existing union type that has grown multiple switch sites.
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
compiler-port
Port a compiler pass from TypeScript to Rust. Gathers context, plans the port, implements in a subagent with test-fix loop, then reviews.
bumping-biome
Bumps biome package versions (e.g. @biomejs/biome) using pnpm, aligns biome.jsonc files with the new version/s across the repository and runs biome-related checks. Use when required to update biome to a newer version - explicitly or implicitly (e.g. after running pnpm up, pnpm update, pnpm upgrade without specific…