Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonichi/sutando --skill marketplacegit clone --depth 1 https://github.com/sonichi/sutandoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonichi/sutando/marketplace)<a href="https://agentmods.dev/skills/sonichi/sutando/marketplace"><img src="https://agentmods.dev/badge/skills/sonichi/sutando/marketplace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonichi/sutando/marketplace"><img src="https://agentmods.dev/badge/skills/sonichi/sutando/marketplace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01276 |
| Opus 5.5 | $0.00030 | $0.00510 |
| Sonnet 5.5 | $0.00015 | $0.00255 |
| Haiku 4.5 | $0.00007 | $0.00128 |
Grade A, and why
marketplace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Marketplace
The owner is already signed in to Sutando Cloud (desktop onboarding), so everything the Marketplace UI does can be done from here: activate a cloud tool, install a local skill, update skills, remove them.
The script lives next to this file. Run it with python3:
M="<this skill's directory>/scripts/marketplace.py"
python3 "$M" find "lead enrichment" # search (add --kind skill|cloud_tool|connector)
python3 "$M" status # owned vs on this machine
python3 "$M" install intent-leads campaign-runner # PLAN only — writes nothing
python3 "$M" install intent-leads campaign-runner --yes
python3 "$M" update # list missing / outdated skills
python3 "$M" update --yes # re-fetch them (never charges)
python3 "$M" uninstall live-preview # PLAN only
python3 "$M" uninstall live-preview --yes
Add --json for machine-readable output. One install call takes skills and
cloud tools together; the script works out which is which.
How to run a setup
- Collect the slugs. From the owner's request, or from a use-case doc
(read it; docs list what they need under a
Requires:heading). If a name isn't an exact slug, runfindfirst. - Plan. Run
install <all slugs>without--yes. Show the owner the plan in a sentence or two (what gets installed or activated, what's already set up, what's skipped and why). - Confirm when it costs something. Exit code
3means the plan spends credits once, or activates a cloud tool that charges per use (the plan says "leads charges per use: 5 credits per result"): tell the owner the price and get their explicit OK first. Exit code0means it's free: go ahead. Never pass--yestouninstallwithout the owner's OK. - Apply. Re-run the same command with
--yes. One failed item doesn't stop the rest. - Use it now; restart only when told. A newly activated cloud tool is
usable at once through
station_find/station_call(the output says "usable now through station_call",usable_nowin JSON): go on with the owner's request in the same turn. Only if the output saysRESTART REQUIRED(restart_required: true) did the running engine start without the Station, or for another account; then tell the owner exactly once, after everything else:
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +2 lines 77bd7563b351
- 1mo ago Changed · +15 lines 1762a3da8dfe
- 1mo ago First seen · 84 lines · 75 tokens per session scan A faaf256fd018
marketplace is a skill published in the GitHub repository sonichi/sutando (397 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 1,276 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
app-builder
Build and edit small, personal visual tools and artifacts — dashboards, trackers, calculators, data visualizations, charts, simple landing pages, and slide decks the user wants for THEMSELVES. This is the right skill whenever the user asks to "visualize this," "make a chart," or "build an artifact" for their own use…
gmail
Manage Gmail email — drafting, sending, organizing, filters, vacation replies, and inbox analysis.
assistant-migration
Migrate from ChatGPT, Claude, OpenClaw, Hermes, Manus, and other AI assistants into Vellum by inspecting their data exports, conversation archives, files, prompts, custom instructions, memory, saved memories, tools, GPTs, workflows, integrations, and relationships, then mapping as much as safely possible into Vellum…
guardian-verify-setup
Set up channel verification for phone, Telegram, Slack, Discord, or email channels via outbound verification flow.
stripe-link-wallet
Agent wallet on the Stripe Link CLI (link-cli). Connect the wallet, then buy, purchase and pay for things on the user's behalf via approved spend requests, one-time-use cards, and 402 / Machine Payment Protocol (MPP) payments.
media-processing
Ingest and process media files (video, audio, image).