Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/squadcodercom/squadcoder/cloudinary-assetsnpx skills add squadcodercom/squadcoder --skill cloudinary-assetsgit clone --depth 1 https://github.com/squadcodercom/squadcoderWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00190 | $0.04212 |
| Opus 5 | $0.00095 | $0.02106 |
| Sonnet 5 | $0.00038 | $0.00842 |
| Haiku 4.5 | $0.00019 | $0.00421 |
Grade A, and why
cloudinary-assets scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Bash(python:*) Bash(curl:*) WebFetch How it starts
The opening of the file, as written. The whole thing — 340 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloudinary Assets
Instructions
Step 1: Verify Cloudinary Configuration
Check for Cloudinary credentials:
import os
def get_cloudinary_config():
"""Get Cloudinary config from environment."""
# Option 1: CLOUDINARY_URL (preferred)
cloudinary_url = os.environ.get('CLOUDINARY_URL')
if cloudinary_url:
return {"url": cloudinary_url}
# Option 2: Individual variables
cloud_name = os.environ.get('CLOUDINARY_CLOUD_NAME')
api_key = os.environ.get('CLOUDINARY_API_KEY')
api_secret = os.environ.get('CLOUDINARY_API_SECRET')
if all([cloud_name, api_key, api_secret]):
return {"cloud_name": cloud_name, "api_key": api_key, "api_secret": api_secret}
return None # Credentials not configured
If not configured, guide the user:
- Sign up at https://cloudinary.com (free tier: 25 credits per month)
- Find credentials in Dashboard, then Programmable Media, then API Keys
- Set CLOUDINARY_URL=cloudinary://API_KEY:API_SECRET@CLOUD_NAME
Step 2: Choose Operation
| Operation | API | Method | When |
|---|---|---|---|
| Upload image | Upload API | POST /image/upload | New image to store |
| Upload video | Upload API | POST /video/upload | New video to store |
| Transform image | URL-based | GET (URL) | Resize, crop, effects |
| Optimize delivery | URL-based | GET (URL) | Performance improvement |
| List assets | Admin API | GET /resources | Browse media library |
| Delete asset | Upload API | POST /image/destroy | Remove media |
| Get asset details | Admin API | GET /resources/{id} | Check metadata |
Step 3: Upload Media
Upload an image:
import requests
import hashlib
import time
def upload_image(file_path, cloud_name, api_key, api_secret,
folder="", tags=None):
"""Upload image to Cloudinary."""
timestamp = str(int(time.time()))
params_to_sign = f"timestamp={timestamp}"
if folder:
params_to_sign = f"folder={folder}&{params_to_sign}"
signature = hashlib.sha1(
f"{params_to_sign}{api_secret}".encode()
).hexdigest()
# Note: This URL requires valid credentials and file upload
url = f"https://api.cloudinary.com/v1_1/{cloud_name}/image/upload"
data = {"api_key": api_key, "timestamp": timestamp, "signature": signature}
if folder:
data["folder"] = folder
if tags:
data["tags"] = ",".join(tags)
with open(file_path, "rb") as f:
response = requests.post(url, data=data, files={"file": f})
return response.json()
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 340 lines · 190 tokens per session scan A b47631b7abc8
cloudinary-assets is a skill published in the GitHub repository squadcodercom/squadcoder (11 stars, last pushed 2mo ago), licensed MIT. It adds 190 tokens to every session and 4,212 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
write-zot-themes
Help the user create, install, or package zot themes, including theme-only extensions.
python-testing
Python testing best practices using pytest including fixtures, parametrization, mocking, coverage analysis, async testing, and test organization. Use when writing or improving Python tests.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Django, TypeORM, golang-migrate). Use when planning or implementing database schema changes.
docker-patterns
Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing Docker configurations.
python-patterns
Python-specific design patterns and best practices including protocols, dataclasses, context managers, decorators, async/await, type hints, and package organization. Use when working with Python code to apply Pythonic patterns.
st-full-workflow
Use when the user asks to run the complete end-to-end Strikethroo workflow for a work order in one shot in this repository — triggers include full workflow, end-to-end, plan and execute, do everything, run the whole strikethroo workflow. Do not use when the user wants only one stage (create a plan, generate tasks, or…