Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tallclub/matimo --skill meta-tools-lifecyclegit clone --depth 1 https://github.com/tallclub/matimoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tallclub/matimo/meta-tools-lifecycle)<a href="https://agentmods.dev/skills/tallclub/matimo/meta-tools-lifecycle"><img src="https://agentmods.dev/badge/skills/tallclub/matimo/meta-tools-lifecycle/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tallclub/matimo/meta-tools-lifecycle"><img src="https://agentmods.dev/badge/skills/tallclub/matimo/meta-tools-lifecycle.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.02743 |
| Opus 5.5 | $0.00015 | $0.01097 |
| Sonnet 5.5 | $0.00007 | $0.00549 |
| Haiku 4.5 | $0.00004 | $0.00274 |
Grade C, and why
meta-tools-lifecycle scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
| `no-ssrf` | URL targets localhost, a private range or `169.254.169.254` | Use a public API | How it starts
The opening of the file, as written. The whole thing — 307 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Meta-Tools Lifecycle: Complete Workflow
This skill teaches you how to take a new tool from idea to first call: validate the YAML, write it to disk, get a human to approve it, reload the registry, and use it. Every tool you create is untrusted — it starts as a draft and cannot run until a human approves it.
The Complete Tool Lifecycle
1. Understand requirements
↓
2. Validate the YAML matimo_validate_tool
↓
3. Create it on disk matimo_create_tool → status: draft, approvalState: pending
↓
4. Reload the registry matimo_reload_tools → the draft is registered, not yet runnable
↓
5. Ask a human to approve it matimo_approve_tool → a human confirms; status: approved
↓
6. Reload again matimo_reload_tools → the approved tool is runnable
↓
7. Call the tool (every call still asks a human: requires_approval is true)
Check progress at any point with matimo_get_tool_status and matimo_list_user_tools.
Step 1: Understand Requirements
Before writing YAML, clarify:
- What it does: read-only (GET) or changes data (POST/PUT/DELETE)
- Which endpoint: a public HTTPS API the developer allows
- Inputs: the parameters it needs
- Output: what the caller should get back
Is it allowed? Untrusted tools must be type: http, must not target localhost, private networks or cloud metadata addresses, must not use a matimo_ name, and must stay within the developer's allowed domains, HTTP methods (GET and POST by default) and credentials.
Step 2: Validate the YAML
Write the complete YAML first
name: weather_lookup # snake_case, unique
version: "1.0.0" # a string
description: Get current weather for a city
parameters:
city:
type: string # string | number | boolean | array | object
required: true
description: City name (e.g., "New York")
execution:
type: http
method: GET
url: "https://api.weatherapi.com/v1/current.json?q={city}"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -208 lines · -2 tokens per session 93d8dd728eca
- 2mo ago First seen · 515 lines · 39 tokens per session scan C 554410db0e6a
meta-tools-lifecycle is a skill published in the GitHub repository tallclub/matimo (18 stars, last pushed yesterday), licensed MIT. It adds 37 tokens to every session and 2,743 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
meta-tools-lifecycle compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| meta-tools-lifecycletallclub/matimo | Skill | 18 | yesterday | MIT | C | 37 | Claude Code, Codex |
| imagegenopenai/codex | Skill | 133k | yesterday | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | yesterday | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | 4d ago | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 313k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 95 | Claude Code |
| next-partial-prefetching-adoptionvercel/next.js | Skill | 143k | today | MIT | A | 103 | Claude Code |