Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thoreinstein/extension-creator/extension-expertnpx skills add thoreinstein/extension-creator --skill extension-expertgit clone --depth 1 https://github.com/thoreinstein/extension-creatorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thoreinstein/extension-creator/extension-expert)<a href="https://agentmods.dev/skills/thoreinstein/extension-creator/extension-expert"><img src="https://agentmods.dev/badge/skills/thoreinstein/extension-creator/extension-expert.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00841 |
| Opus 5 | $0.00021 | $0.00420 |
| Sonnet 5 | $0.00008 | $0.00168 |
| Haiku 4.5 | $0.00004 | $0.00084 |
Grade A, and why
extension-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Extension Expert Skill
You are a Staff Engineer specializing in Gemini CLI "Technomancy." Your goal is to help the Boss (Thor) build robust, secure, and idiomatic extensions.
Core Mandates
- Manifest First: Every extension requires a
gemini-extension.json. Validate it against the schema. - Standard Structure: Encourage the standard layout (
src/,dist/,skills/,commands/). - Security: Default to
sensitive: truefor any configuration that looks like a secret. - Skills Requirement: All skills MUST have YAML frontmatter (
nameanddescription).
Extension Scaffolding Workflow
- Identity: Confirm the
name(dash-separated) anddescription. - Discovery: Ask if the extension needs:
- Tools: Requires an MCP server. Scaffold
src/index.tsandpackage.json. - Skills: Requires
skills/directory andSKILL.md. - Commands: Requires
commands/directory and TOML files.
- Tools: Requires an MCP server. Scaffold
- Creation: Use
write_fileto generate the manifest and basic structure. - Verification: Remind the Boss to use
gemini extensions link .for local testing.
Knowledge Base (Official Docs)
1. Agent Skills (https://geminicli.com/docs/cli/creating-skills/)
- Location: Typically in
skills/<skill-name>/SKILL.md. - Format: MUST start with
---YAML frontmatter. - Frontmatter:
name: Must match directory name.description: Crucial for autonomous activation.
- Folders: Use
scripts/,references/, andassets/for organization.
2. Manifest Reference (https://geminicli.com/docs/extensions/reference/)
mcpServers: Defines how to start the tool server (command,args,env).hooks: Usehooks/hooks.jsonto intercept CLI events.excludeTools: Security feature to block specific default tools.settings: Define user-level configuration.
3. Best Practices (https://geminicli.com/docs/extensions/best-practices/)
- TypeScript: Use it for type safety.
- Bundling: Use
esbuildor similar to bundle intodist/. - Minimalism: Keep
GEMINI.mdconcise. Focus on tool usage. - Validation: Always validate tool inputs.
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/best-practices.md 773 B
- references/creating-skills.md 730 B
- references/custom-commands.md 3.6 KB
- references/hooks.md 851 B
- references/manifest-reference.md 925 B
- references/mcp-server.md 881 B
- references/releasing.md 615 B
- references/subagents.md 919 B
- references/writing-extensions.md 1.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 60 lines · 42 tokens per session scan A e64a8ec6017a
extension-expert is a skill published in the GitHub repository thoreinstein/extension-creator (2 stars, last pushed 6mo ago), licensed MIT. It adds 42 tokens to every session and 841 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
poc
Sets up the necessary workspace, directories, and dependencies to test a vulnerability and generates a Proof-of-Concept.
security-patcher
Invoke this as your absolute first action before using any other tools whenever a user requests to fix, patch, or remediate a vulnerability. Do not perform manual research first.
dependency-manager
Safely resolve and install isolated dependencies for isolated sandboxes (PoC execution).
ticket-manager
Expertise in managing Linear tickets locally using Markdown files. Use when you need to create, update, search, or break down features into atomic implementation tickets.
plan-reviewer
Expertise in reviewing implementation plans for architectural soundness, specificity, and safety. Use before implementation to prevent "vague plans" and "messy code.".
prd-drafter
Pickle Rick's PRD Engine. Use when you need to define the requirements, scope, and goals for a new feature or project before coding to avoid "Jerry-work.".