write-terva-extension

write-terva-extension is a skill for Claude Code, Codex from terva-sh/terva. It costs 67 tokens per session (4,767 once invoked), scanned C, original, MIT.

Instructions for creating terva extensions, which are executable programs that terva runs as separate processes.

In plain words
What is it for?
Use them to build slash commands, tools the language model can call, audit hooks, or permission gates in any language that reads and writes JSON lines.
Why use it?
They explain how to add behavior that written instructions alone cannot provide, while keeping extension failures isolated from terva.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use them to build slash commands, tools the language model can call, audit hooks, or permission gates in any language that reads and writes JSON lines.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/terva-sh/terva/write-terva-extension
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add terva-sh/terva --skill write-terva-extension
Clone the repo
git clone --depth 1 https://github.com/terva-sh/terva

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for write-terva-extension

README.md
[![agentmods](https://agentmods.dev/badge/skills/terva-sh/terva/write-terva-extension.svg)](https://agentmods.dev/skills/terva-sh/terva/write-terva-extension)
Your own site
<a href="https://agentmods.dev/skills/terva-sh/terva/write-terva-extension"><img src="https://agentmods.dev/badge/skills/terva-sh/terva/write-terva-extension.svg" alt="Measured on agentmods" height="20"></a>
Per session 67 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,767 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00067 $0.04767
Opus 5 $0.00034 $0.02384
Sonnet 5 $0.00013 $0.00953
Haiku 4.5 $0.00007 $0.00477

Measured 7d ago against content hash a0f578ae519b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade C, and why

write-terva-extension scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

"tool_name":"bash","tool_args":{"command":"rm -rf /tmp/foo"}}
packages/agent/skills/builtin/write-terva-extension/SKILL.md · 474 lines

How it starts

The opening of the file, as written. The whole thing — 474 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Writing a terva extension

Use this skill when the user asks for help building a terva extension — a new slash command, a new tool the LLM can call, an audit hook, or a permission gate. Skim this whole skill first, then collaborate with the user on the specific extension they want.

What an extension is

A terva extension is an external executable that terva launches as a subprocess and talks to over its stdin/stdout in newline-delimited JSON. It can be written in any language that can read/write JSON lines from stdio: Go, TypeScript (via tsx), Python, Rust, shell with jq, anything. Crash isolation is automatic; one bad extension never takes down terva.

Three things an extension can do (any combination):

  1. Slash commands — register /foo so the user can run it from the input. The handler returns a "prompt" (submitted to the agent), an "insert" (text dropped into the editor), a "display" (one-shot styled note in the chat), or a "noop".

  2. Tools — register tools the LLM itself calls. Schema is JSON Schema; terva routes the model's tool_call to the extension's tool_result. Same lifecycle as built-in tools (read/write/edit/bash/skill).

  3. Lifecycle hooks — subscribe to events (session_start, turn_start, tool_call, turn_end, assistant_message) for telemetry / audit / custom UI, or intercept tool calls before execution to refuse dangerous patterns.

  4. Model context & tool visibility — fold standing guidance into the system prompt (register_context / refresh_context) and hide tools that can't do anything useful in the current workspace (set_withdrawn_tools). These touch the model's cached prefix, so they carry a discipline — see "Being responsible with context & tools" below before reaching for them.

On-disk layout

Each extension lives in its own directory:

~/Library/Application Support/terva/extensions/<name>/
├── extension.json    # manifest (required)
└── <executable>      # whatever exec points at

Read the full file on GitHub · 474 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 474 lines · 67 tokens per session scan C a0f578ae519b

Subscribe to this mod's changes

write-terva-extension is a skill published in the GitHub repository terva-sh/terva (2 stars, last pushed today), licensed MIT. It adds 67 tokens to every session and 4,767 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

pi-sync

Daily upstream-sync job for the pi Go port — fetch upstream pi, triage every change since the recorded pin, port what's in scope, verify idiomatic + parity via independent reviews, update the ledger, and push. Use for "sync with upstream", "porting job", or as the scheduled daily run.

sky-valley/pi · 66 tokens

pi-go-review

Review ported Go code for idiomatic quality — that the port maximizes Go rather than transliterating TypeScript. Use after porting upstream pi changes, or standalone on any diff in this repo.

sky-valley/pi · 45 tokens

sls-dashboard-builder

A tool for creating and modifying importable JSON dashboards for Alibaba Cloud SLS, a service for searching and monitoring logs. It maps checked queries and analysis needs to dashboard charts.

alibaba/loongsuite-pilot · 72 tokens

loongsuite-pilot-insight

A reporting workflow for turning LoongSuite Pilot and AI coding-agent logs into structured reports about events, teams, data quality, development efficiency, and AI use. It defines the meaning of the log fields and the measurements used in dashboards.

alibaba/loongsuite-pilot · 91 tokens

code-guidelines-go

Go 1.24–1.27 coding guidelines for the dimetron/pi-go AI agent runtime. Use this skill whenever writing, reviewing, or refactoring ANY Go code in pi-go. This covers idiomatic style, error handling, concurrency, project layout, testing (table-driven, fuzz, benchmarks, synctest), new stdlib usage, golangci-lint v2…

dimetron/pi-go · 124 tokens

go-127

What changed in Go 1.27 (released August 2026) and how it changes the way Go is written in pi-go. Use this skill when writing or reviewing Go that could use a 1.27 feature, when bumping the go directive in go.mod, when a build or test behaves differently after a toolchain upgrade, or when code-guidelines-go points…

dimetron/pi-go · 177 tokens