Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TheGoat395/Codex-Skills --skill frontend-tooling-trust-gategit clone --depth 1 https://github.com/TheGoat395/Codex-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thegoat395/codex-skills/frontend-tooling-trust-gate)<a href="https://agentmods.dev/skills/thegoat395/codex-skills/frontend-tooling-trust-gate"><img src="https://agentmods.dev/badge/skills/thegoat395/codex-skills/frontend-tooling-trust-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thegoat395/codex-skills/frontend-tooling-trust-gate"><img src="https://agentmods.dev/badge/skills/thegoat395/codex-skills/frontend-tooling-trust-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.00381 |
| Opus 5 | $0.00008 | $0.00191 |
| Sonnet 5 | $0.00003 | $0.00076 |
| Haiku 4.5 | $0.00002 | $0.00038 |
Grade A, and why
frontend-tooling-trust-gate scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
5. Look for preinstall/postinstall scripts, broad permissions, telemetry, token requests, cookie access, or curl-to-shell commands. What it actually says
Frontend Tooling Trust Gate
Use this skill before installing or recommending a repo, package, MCP, plugin, template, or script.
Trust Classes
preferred: official or clearly reputable.acceptable: useful, maintained, and reasonably transparent.inspect manually: promising but insufficiently verified.avoid: suspicious, stale, unsafe, or low-quality.unknown risk: not enough evidence.
Inspection Checklist
- Prefer official sources, verified orgs, and vendor-maintained repos.
- Inspect README specificity, license, SECURITY.md, recent commits, releases, issues, and package registry links.
- Inspect
package.json, scripts, dependencies, and install instructions. - Use
npm view <package> repository license version time maintainerswhen npm metadata matters. - Look for preinstall/postinstall scripts, broad permissions, telemetry, token requests, cookie access, or curl-to-shell commands.
- Prefer project-local installs for frontend tools and libraries.
- Avoid global installs unless the tool is an agent-wide CLI and the user explicitly approves it.
- Never expose API keys, browser cookies, SSH keys, tokens, or private files to unknown tools.
Decision Output
Return:
- source and type
- trust class
- evidence
- red flags
- install stance:
install,project-local only,do not install, orneeds user auth - safer official alternative if rejected
Scope and evidence
Apply to frontend tooling adoption only. Reuse recent verified adoption decisions if no relevant version, source, permission or requirement changed. Stale maintenance is a factor, not proof of malice. Existing authorization covers routine approved installs; spending and external commitments keep their actual boundaries.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +4 lines · -61 tokens per session e4ba9fea0c6b
- 11d ago First seen · 39 lines · 76 tokens per session scan A e752d7093939
frontend-tooling-trust-gate is a skill published in the GitHub repository TheGoat395/Codex-Skills (122 stars, last pushed today), licensed MIT. It adds 15 tokens to every session and 381 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
design-pipeline
A build-and-test workflow for turning Figma designs into shadcn/ui components, a reusable set of interface components for React-based projects. It checks the result in a real browser at three screen sizes and runs accessibility checks.
swiftui-animation
Implement, diagnose, or review SwiftUI motion using explicit and scoped implicit animations, springs, transitions, PhaseAnimator, KeyframeAnimator, matched geometry or navigation zoom, SF Symbol effects, and custom Animation types. Use when views should animate on state changes, insertion, removal, navigation, or…
swiftui-gestures
Implement, review, or improve SwiftUI gesture handling. Use when adding tap, long press, drag, magnify, or rotate gestures, composing gestures with simultaneously/sequenced/exclusively, managing transient state with @GestureState, resolving parent/child gesture conflicts with highPriorityGesture or…
swiftui-layout-components
Build SwiftUI layouts using stacks, grids, lists, scroll views, forms, and controls. Covers VStack/HStack/ZStack, LazyVGrid/LazyHGrid, List with sections and swipe actions, ScrollView with ScrollPosition and scroll-driven reveal surfaces, Form with validation, Toggle/Picker/Slider, .searchable, and overlay patterns.…
swiftui-webkit
Embeds and controls web content in SwiftUI with WebKit for SwiftUI, including WebView, WebPage, navigation policies, JavaScript execution, observable page state, link interception, local HTML or data loading, and custom URL schemes. Use when building iOS 26+ article/detail views, help centers, in-app documentation, or…
focus-engine
Implements keyboard, directional, and scene-level focus behavior across SwiftUI and UIKit. Use when managing @FocusState, defaultFocus, focused values, focusable interactions, focus sections, tvOS geometric focus and Siri Remote navigation, watchOS Digital Crown input, visionOS connected-device focus versus gaze…