Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add smk-labs/claude-plugins --skill reportgit clone --depth 1 https://github.com/smk-labs/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/smk-labs/claude-plugins/report)<a href="https://agentmods.dev/skills/smk-labs/claude-plugins/report"><img src="https://agentmods.dev/badge/skills/smk-labs/claude-plugins/report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/smk-labs/claude-plugins/report"><img src="https://agentmods.dev/badge/skills/smk-labs/claude-plugins/report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 3 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 43 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- medium Excessive Agency · line 68 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.03047 |
| Opus 5.5 | $0.00023 | $0.01219 |
| Sonnet 5.5 | $0.00011 | $0.00609 |
| Haiku 4.5 | $0.00006 | $0.00305 |
Grade A, and why
report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
report: the chat card, as a standalone HTML file
One goal: the saved report looks EXACTLY like the chat cards. You never design, never write CSS; a script injects the kit.
Workflow
- Collect content. Exporting an existing card: reuse its md (or its HTML, if it was sent as html) verbatim, then apply only the changes asked for. Otherwise write fresh content. Write it in the SAME md the
cardtool takes: GitHub Markdown plus its:::blocks (kpi, kv, bars, spark, tl, hub, cards, cols, box, cta, preview),:ok[..]badges,:ic[..]icons,{.lead}/{.src}/{.pick}/{.wide}. The report adds what a chat card lacks:alone on a line is a figure (read Images: when, and when not first),:::donutwithlabel | valuerows,:::fold titlefor collapsible detail,:::numbered(or:::numbered sections) around the body for numbered sections, and:::tabswith[label](#id)rows against## heading {#id}. Skip:::cta:sendPromptdoes not exist in a standalone file. Raw HTML still passes through for anything else. - Write the content to a temp file (scratchpad), e.g.
content.md. A.htmlfragment of building blocks still works. - Build:
- Persian:
python3 "<this skill dir>/build.py" content.md -o <target>.html - English: add
--lang en(LTR + Inter automatically) --title "..."optional; defaults to the<h2>text. Default output name if the user gave none:report-<short-slug>.htmlin the project directory (or the path they named).
- Persian:
- Deliver: the script prints the absolute path; report it as a clickable link. Offer to open it in the browser. Do not paste the HTML into chat.
Cards or a table?
Both compare options. They fail at opposite things, and authors get this backwards.
- A table wins when you compare many attributes across few options and column alignment matters. The reader scans down one column to rank everything on that attribute.
- Cards win when each option has a narrative and must read as a unit: a sentence of reasoning, a short list, a verdict badge. A row of a table cannot hold a paragraph.
- The best comparison layouts use both: cards for the summary and the verdict, a table below for the detail matrix.
- Do NOT turn a four-option comparison into a wide sideways-scrolling table. It scatters each option's story across a dozen rows, and it reads badly on a narrow screen and in print. That is the case
cardsexists for. - In a decision document, mark the chosen option
card pick. The highlighted option carries half the message.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed b28a4ade3624
- 1mo ago Changed · +3 lines · -72 tokens per session 0cc802bb0f49
- 1mo ago First seen · 115 lines · 129 tokens per session scan A 7ef8f54124ac
report is a skill published in the GitHub repository smk-labs/claude-plugins (11 stars, last pushed 28d ago), licensed MIT. It adds 57 tokens to every session and 3,047 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
proof-points
Builds and maintains a sourced, gated registry of the proof points your messaging relies on (metrics, customer quotes, case study results, analyst citations), then deepens brain Section 6. Use when pulling proof points out of a deck or battlecard, checking whether a stat is safe to use, sourcing a new claim before it…
summarize-meeting
Summarize a meeting transcript into structured notes with date, participants, topic, key decisions, summary points, and action items. Use when processing meeting recordings, creating meeting notes, writing meeting minutes, or recapping discussions.
summarize-interview
Summarize a customer interview transcript into a structured template with JTBD, satisfaction signals, and action items. Use when processing interview recordings or transcripts, synthesizing discovery interviews, or creating interview summaries.
visual-explainer
Generate self-contained HTML pages that visually explain technical material — systems, code changes, plans, data. Use when the user asks for any diagram or visual explanation, when they want a slide deck or a longform document (user guide, how-to, reference page), when another skill needs one rendered, or proactively…
reflect-solution
Summarize WHAT WAS SHIPPED in a Claude Code session as a self-contained HTML slide deck — the elevator pitch (problem, solution, decisions, artifacts, verification, gaps), not a play-by-play of tool calls or debugging detours. Defaults to the current in-context session; optionally accepts a session ID or JSONL path.…
pmm-resume
Reviews and tailors a PMM resume (IC to VP, including AI PMM roles): dissects the job description, ranks bullets by impact fit and rebuilds the complete resume in one pass. Trigger on: resume + JD paste, "tailor this", "which bullets for this role", "rebuild for [company]", "review my PMM resume", "reframe for…