Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add thangchung/agent-engineering-experiment --skill coffeeshop-customer-lookupgit clone --depth 1 https://github.com/thangchung/agent-engineering-experimentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thangchung/agent-engineering-experiment/coffeeshop-customer-lookup)<a href="https://agentmods.dev/skills/thangchung/agent-engineering-experiment/coffeeshop-customer-lookup"><img src="https://agentmods.dev/badge/skills/thangchung/agent-engineering-experiment/coffeeshop-customer-lookup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thangchung/agent-engineering-experiment/coffeeshop-customer-lookup"><img src="https://agentmods.dev/badge/skills/thangchung/agent-engineering-experiment/coffeeshop-customer-lookup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00243 |
| Opus 5 | $0.00014 | $0.00121 |
| Sonnet 5 | $0.00005 | $0.00049 |
| Haiku 4.5 | $0.00003 | $0.00024 |
Grade A, and why
coffeeshop-customer-lookup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Coffee Shop Customer Lookup Skill
Use this skill when the user asks account-related questions or provides customer identifiers.
Data Access — lookup_customer
tools/call customer_lookup {"email":"<email>"}or{"customer_id":"<id>"}Coffeeshop-Cli models query Customer --email <email> --json(or--customer-id <id>, ormodels browse Customer --json)
Normalize to: {"customer_id":"...","name":"...","email":"...","tier":"..."}
Workflow
- Extract email or customer ID from context.
- Resolve
lookup_customer. Prefer specific lookup over broad browse. - Return normalized summary.
Safety Notes
- Never infer identity from a weak match.
- Never expose unrelated customer records.
- If lookup fails, ask for exact email/customer ID.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 35 lines · 27 tokens per session scan A d9d432de2d15
coffeeshop-customer-lookup is a skill published in the GitHub repository thangchung/agent-engineering-experiment (25 stars, last pushed 1mo ago), licensed MIT. It adds 27 tokens to every session and 243 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
postgres-commit-history-article
A workflow for comparing PostgreSQL source-code changes between two Git commits and, when useful, writing a Chinese Markdown article about them. PostgreSQL is a database system, and a commit is a saved change in a Git repository.
b2c-querying-data
Write efficient data queries in B2C Commerce for products, customers, and orders. Use this skill whenever the user needs to search products on a storefront page, look up customer profiles, query orders, paginate search results, or fix slow category pages. Also use when they ask about performance problems with data…
b2c-custom-objects
Store and query custom business data using CustomObjectMgr, OCAPI Data API, and Shopper Custom Objects API. Use this skill whenever the user needs to create, read, update, or search custom object instances, build processing queues with status fields, choose between site-scoped and organization-scoped storage, or query…
rp-mapper
Maps discovered source entities and fields to Wix targets and documents lossiness. Use when creating machine-readable mapping artifacts and review markdown after discovery.
wc-hpos-compatibility
Make WooCommerce order integrations compatible with High-Performance Order Storage. Covers compatibility declaration, order CRUD and queries, authoritative storage, sync-setting versus fully-synced checks, HPOS-aware admin list/meta-box hooks, cache-safe metadata access, large-store query optimization boundaries…
wc-product-crud-cache
Read and write WooCommerce products safely through WCProduct CRUD while accounting for the WooCommerce 11.0 productinstancecaching request cache. Covers view versus edit context, save and invalidation boundaries, direct WordPress meta writes, raw SQL hazards, variation-parent synchronization, taxonomy recount…