Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tigu77/tiguclaw --skill app-ai-wiringgit clone --depth 1 https://github.com/tigu77/tiguclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tigu77/tiguclaw/app-ai-wiring)<a href="https://agentmods.dev/skills/tigu77/tiguclaw/app-ai-wiring"><img src="https://agentmods.dev/badge/skills/tigu77/tiguclaw/app-ai-wiring/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tigu77/tiguclaw/app-ai-wiring"><img src="https://agentmods.dev/badge/skills/tigu77/tiguclaw/app-ai-wiring.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 193 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00232 | $0.03708 |
| Opus 5 | $0.00116 | $0.01854 |
| Sonnet 5 | $0.00046 | $0.00742 |
| Haiku 4.5 | $0.00023 | $0.00371 |
Grade A, and why
app-ai-wiring scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -H "Authorization: Bearer <TOKEN>" http://127.0.0.1:<port>/v1/models How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
앱 ↔ AI 연결 배선 (tiguclaw)
앱에 AI 를 붙이는 방법은 두 가지다. 성격이 완전히 달라 먼저 고르고 배선한다. 사용자가 지정했으면 그대로 따르고, 안 정했으면 §1 로 추천 + 확인받는다(맘대로 정하지 말 것).
§1 어느 쪽인가 — 판단 기준
| A. tiguclaw 직결 엔드포인트 | B. OpenAI 호환 게이트웨이 | |
|---|---|---|
| 앱이 얻는 것 | 비서 자체(도구·스킬·메모리·서브에이전트·프로젝트 맥락) | LLM 한 방(순수 텍스트 생성) |
| 규약 | 없음 — 내가 자유 설계 | OpenAI 스펙 고정 |
| 교체 | tiguclaw 전용(스왑 불가) | OpenRouter·OpenAI 로 baseURL 만 바꿔 스왑 |
| 반영 | 재시작 불요(데이터 기반) | 토큰 설정 시 재시작 필요(.env) |
A 를 고르는 신호: "내 파일 읽어서", "메모리 참고해서", "스킬 태워서", "프로젝트 맥락 알고", 여러 단계 자율 작업, tiguclaw 만의 능력이 핵심일 때. B 를 고르는 신호: 요약·분류·번역·챗봇 등 모델만 있으면 되는 일, 나중에 상용 API 로 갈아탈 계획, 이미 OpenAI SDK 로 짠 앱, 함수호출/비전 같은 표준 기능이 필요할 때.
애매하면 B(표준이라 나중에 A 로 못 바꾸는 손해가 없고, 스왑 자유). 단 "비서를 부르고 싶은 것"이면 B 로는 절대 안 되니 A.
§2 모드 A — tiguclaw 직결 커스텀 엔드포인트
엔드포인트 = 슬래시 명령의 HTTP 판. <home>/endpoints/<name>.md(frontmatter + 프롬프트
템플릿)를 http-bridge 가 매 요청 발견해 서빙한다. 임의 코드 0 = 데이터만, 재시작 불요.
배선
register_endpoint도구로 등록(list_endpoints/delete_endpoint로 조회·삭제).path— 라우트(예/weather). 슬래시 시작·소문자 정규화.method—GET|POST(기본 POST).role— 인증 게이트(기본write). 앱은 bridge 토큰으로 호출.mode— 기본restricted(도구 0). 비서 도구가 필요하면 명시적으로 열어야 함.- 본문 = 프롬프트 템플릿(요청 파라미터를 끼워 넣음).
- 앱은 그 경로를 호출:
POST http://127.0.0.1:<HTTP_BRIDGE_PORT>/<path>+ bridge 토큰.
동기 / 스트리밍
엔드포인트도 둘 다 된다 — 앱이 고른다.
- 동기(기본): 그냥 POST →
{ "result": "<본문>" }한 번에. 앱 코드 2줄. - 스트리밍: body 에
"stream": true(또는?stream=1) → SSE.
★앱은 result/error 를 받았는지로 성패를 판정할 것(연결만 끊긴 것과 구분). ★data: {"type":"delta","text":"…"} 진행 조각(0회 이상) data: {"type":"result","result":"…"} 최종(성공 시 1회) data: {"type":"error","error":"…"} 실패(1회) data: [DONE] 종료 표식EventSource는 POST 불가 →fetch+ReadableStream으로 읽는다. - 타임아웃: 엔드포인트 전용
ENDPOINT_TIMEOUT_MS(기본 5분, env 조정). 폴백 낀 긴 턴(70초)이 504로 잘리던 실사고 때문에 분리·상향했다. 스트리밍이면 데이터가 흘러 중간 계층(프록시·Tailscale) idle timeout 도 회피된다.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -2 lines 2c06f12f4003
- 6d ago Changed · +1 lines 1a12dce2bdfd
- 11d ago First seen · 208 lines · 232 tokens per session scan A 6dfa6e2cad54
app-ai-wiring is a skill published in the GitHub repository tigu77/tiguclaw (6 stars, last pushed today), licensed Apache-2.0. It adds 232 tokens to every session and 3,708 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
serving-llms-vllm
Use when deploying production LLM APIs, optimizing inference latency/throughput, or serving models with limited GPU memory. Supports OpenAI-compatible endpoints, quantization (GPTQ/AWQ/FP8), and tensor parallelism.
open-source
Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browseruse, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle…
data-leakage-detection
Detect sensitive information disclosure via escalating dialogue probes. Covers system prompt extraction, credential/API key leakage, PII, and internal configuration exposure.
bridging-presidio-and-spacy
Combine OpenMed clinical NLP with Microsoft Presidio, spaCy, or LangChain through OpenMed's built-in interop adapter registry (openmed.interop). Covers the lazy adapter registry (availableadapters, getadapter, adapterspec), the presidio/spacy/langchain pip extras, and the verified callables — Presidio…
server-inference
Use this skill when the user wants to run or debug MLX-VLM server inference, including uv run mlxvlm.server, /v1/models, /v1/chat/completions, /v1/responses, streaming, OpenAI-compatible clients, health checks, metrics, model unload/reload, adapters, trust-remote-code, and server request/response failures.
groq-inference
Ultra-fast LLM inference on custom LPU hardware. OpenAI-compatible API at api.groq.com. Lowest latency in the industry (500-1000+ tok/s). Supports chat completions, vision, audio (Whisper STT + TTS), tool calling, JSON mode, and streaming. Free tier available. Inference only — no training.