Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/t1djani/servo/scan-projectnpx skills add t1djani/servo --skill scan-projectgit clone --depth 1 https://github.com/t1djani/servoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/t1djani/servo/scan-project)<a href="https://agentmods.dev/skills/t1djani/servo/scan-project"><img src="https://agentmods.dev/badge/skills/t1djani/servo/scan-project.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01025 |
| Opus 5 | $0.00032 | $0.00513 |
| Sonnet 5 | $0.00013 | $0.00205 |
| Haiku 4.5 | $0.00006 | $0.00103 |
Grade A, and why
scan-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
scan-project
Give servo a project's .servo/manifest.yaml without hand-writing it. This skill discovers the project's sources of truth and its domains, then proposes a manifest. It is what makes one generic plugin work on any project — the manifest is the only project-specific adapter, and this builds it.
Discover, do not ingest
The goal is a map of pointers, not a copy of the project. Sample enough signal to infer where truth lives and which domains exist; do not read everything. The output is the manifest, not an index.
Procedure
-
Enumerate candidate sources, tool-agnostic. Look for:
- local directories and files (codebase,
docs/, notes, ADRs), - connected MCP servers (a tracker, a notes store, a database),
- any declared memory or knowledge base.
The source forms that end up in the manifest are generic (
path/...,git:main,issue:{id},vault:...) — seedocs/manifest.md.
- local directories and files (codebase,
-
Infer the experts (domains) — from the code, not from the tooling. Read the project's actual structure (its domain folders, its docs) and infer the domains it has. Do not just mirror the existing skills, agents, or tools: those are sources, not the list of domains. A project's core domain often has no skill of its own — infer it anyway from the code (a
domain/coaching/folder is a coaching expert whether or not a coaching skill exists). For each domain, a seat is a role plus pointers to where its knowledge lives — its depth comes from the sources it points at, read when convened. A scanned "design expert" that points at the real tokens file is deep; a generic one is not. Propose every domain the layout reveals, including ones with no existing skill or tool. -
Match each expert against the existing skills, then fill the gaps. For every domain you inferred:
- If an existing skill matches the domain (a
designexpert and adesignskill), wire that skill in as one of the expert'ssourcesand reuse it. Do not duplicate it. - If no skill matches, flag it: this domain has no curated expert skill. When the domain carries enough specific, reusable knowledge to be worth one (rules, lore, checks that go beyond "read these files" — e.g. a scoring system, a compliance rule), propose creating an expert skill for it. A source-pointer expert works without a skill; a curated skill is worth it only when the domain has real encodable knowledge.
- Never create a skill silently. List the expert skills you propose to create, say what each would encode and where it would live (the project's own skill directory), and create them only after the human approves. The human may accept all, some, or none — the rest stay as source-pointer experts.
- If an existing skill matches the domain (a
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 40 lines · 63 tokens per session scan A a08d84a2971c
scan-project is a skill published in the GitHub repository t1djani/servo (1 stars, last pushed 2mo ago), licensed MIT. It adds 63 tokens to every session and 1,025 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
quiz-me
Quiz the user on root cause and intended fix BEFORE writing any non-trivial code, then verify comprehension of every change after. Use when the user asks for a bug fix, refactor, or feature and wants to stay technically sharp instead of vibe-coding. Also use when the user says "quiz me", "don't let me vibe code", or…
website-deploy-builder
Plan what to build on Website Deploy (simple-host.app). Helps a user decide whether their idea fits the static + light-backend model, maps it to concrete patterns (shared JSON state with atomic ops, append-only collections, private/password-locked pages on a custom domain, drop-in comments/feedback widgets…
craft
Engineering standards for any code work on any stack — writing production code, slicing and reviewing PRs, authoring tests, running gates, merging, and running agent fleets. Load before touching code, not after review flags it.
connect-domain
Connect a user's own custom domain (subdomain e.g. recipes.brand.com via CNAME, or apex e.g. brand.com via A record) to a site already deployed on simple-host. Use when a user wants their site served from their own domain with automatic HTTPS, or wants a private/password-protected site (privacy is offered only on a…
personal-voice-capture
Use when a user wants an agent to learn, encode, or improve their personal writing voice as a reusable skill through source-text ingestion and iterative calibration edits.
demo-video-factory
Generate a custom 26s product-demo video from any SaaS URL — brand-matched scenes, a recreated product-UI "wow" scene, real screenshots, and a soundtrack. Use whenever the user wants a demo, promo, launch, or marketing video for a website or product.