Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add thewolffish/wolffish-app --skill nodegit clone --depth 1 https://github.com/thewolffish/wolffish-appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thewolffish/wolffish-app/node)<a href="https://agentmods.dev/skills/thewolffish/wolffish-app/node"><img src="https://agentmods.dev/badge/skills/thewolffish/wolffish-app/node/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thewolffish/wolffish-app/node"><img src="https://agentmods.dev/badge/skills/thewolffish/wolffish-app/node.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00009 | $0.00831 |
| Opus 5.5 | $0.00004 | $0.00332 |
| Sonnet 5.5 | $0.00002 | $0.00166 |
| Haiku 4.5 | $0.00001 | $0.00083 |
Grade B, and why
node scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Do NOT install Node yourself with raw `shell_exec` `sudo apt install nodejs` (or What it actually says
Node.js
Usage
Use node_check to verify a usable Node.js (24+) is available and get the version.
If not, call node_install (requires user approval) — and trust it.
node_install is the default and needs no admin rights: it reuses an existing
global Node ≥24 if one is present, and otherwise downloads the official no-root
Node into ~/.wolffish/bin. No package manager, no password prompt. This is the
same managed-first policy the python capability uses, so it works the same on a
fresh machine with nothing pre-installed.
node_install_system is optional and only for when the user explicitly wants
a globally visible Node in their own terminal. It installs system-wide via the OS
(Homebrew / official MSI+UAC / apt|dnf+sudo) and prompts once for the admin
password; if elevation is declined or unavailable, it falls back to the no-root
copy so the user is never left stuck. Prefer node_install unless asked otherwise.
Do NOT install Node yourself with raw shell_exec sudo apt install nodejs (or
pkexec/brew/winget/msiexec). Use the tools above — they route through the
shared password session and the approval gate. If one returns a permission or
"password prompt cancelled" error, surface it; that error is deterministic, so
don't retry the same command.
Once installed, use the shell_exec tool for node, npm, and npx commands.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 2ff0a5114f41
- 1mo ago First seen · 118 lines · 9 tokens per session scan B ce527f0679e7
node is a skill published in the GitHub repository thewolffish/wolffish-app (5 stars, last pushed 22d ago), licensed MIT. It adds 9 tokens to every session and 831 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
typescript-best-practices
TypeScript best practices. Use when reading or editing any .ts or .tsx file.
node-modern
Use this skill when writing, reviewing, or refactoring Node.js code — modules, async flow, cancellation, file and process I/O, HTTP — on a current Node.js release. Triggers: user mentions "Node", "Node.js", "ESM", "CommonJS", "require", "import", "fetch", "AbortSignal", "AbortController", "stream", "childprocess"…
typescript-strict
Use this skill when writing, reviewing, or fixing TypeScript where type safety matters — type errors, narrowing, unsafe casts, or tightening compiler strictness. Triggers: user mentions "TypeScript", "type error", "tsc", "strict", "type safety", "narrowing", "any", "unknown", "discriminated union", "branded type"…
typescript-strict
TypeScript strict mode patterns with interfaces, type guards, generics, and utility types. Use when defining types, creating type-safe functions, handling nullable values, or implementing generic components.
angular
Use when building, refactoring, or debugging Angular (v20/21+): standalone components, signals, zoneless change detection, @if/@for/@defer control flow, inject() DI, resource()/httpResource(), RxJS interop, NgRx SignalStore, ng CLI. NOT React (that is react), NOT Next.js (that is nextjs), NOT a TypeScript language…
nestjs
Use when building or structuring a NestJS backend — feature modules, providers and DI wiring, provider scopes and request-lifecycle order, where to bind guards/pipes/interceptors/filters, and testing with Test.createTestingModule. NOT a bare Express/Fastify service with no DI (that is nodejs), NOT framework-agnostic…