Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tonylofgren/aurora-smart-home --skill api-cataloggit clone --depth 1 https://github.com/tonylofgren/aurora-smart-homeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tonylofgren/aurora-smart-home/api-catalog)<a href="https://agentmods.dev/skills/tonylofgren/aurora-smart-home/api-catalog"><img src="https://agentmods.dev/badge/skills/tonylofgren/aurora-smart-home/api-catalog/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tonylofgren/aurora-smart-home/api-catalog"><img src="https://agentmods.dev/badge/skills/tonylofgren/aurora-smart-home/api-catalog.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 33 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 59 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Data Exfiltration · line 79 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 104 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 90 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00132 | $0.01191 |
| Opus 5 | $0.00066 | $0.00596 |
| Sonnet 5 | $0.00026 | $0.00238 |
| Haiku 4.5 | $0.00013 | $0.00119 |
Grade A, and why
API Catalog scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Catalog for Home Assistant
Reference skill for connecting external APIs and services to Home Assistant.
Overview
This skill covers authentication patterns and working code examples for connecting popular APIs to Home Assistant via three methods:
- Node-RED - HTTP request node flows (fastest to get running)
- HA YAML -
restsensor andrest_command(good for simple polling) - Custom integration - Full HACS-publishable Python component (use
ha-integrationskill)
The Iron Law
CREDENTIALS IN SECRETS - NEVER HARDCODED IN FLOWS OR YAML
API keys belong in Node-RED credentials, ESPHome secrets.yaml, or HA secrets.yaml.
Never paste real tokens into chat, flows that get exported, or YAML committed to git.
How to Use This Skill
- User mentions an API or service by name
- Read the relevant reference file for auth setup and endpoints
- Generate working code for the user's chosen method (Node-RED / YAML / integration)
- Include credential setup instructions
Reference Files
| Category | File | APIs Covered |
|---|---|---|
| Energy & electricity | references/energy-apis.md |
Tibber, Nordpool, Energi Data Service |
| Weather | references/weather-apis.md |
SMHI, OpenWeatherMap, yr.no, Tomorrow.io |
| Transport | references/transport-apis.md |
SL, Trafikverket, Resrobot, Entur (NO) |
| Smart home clouds | references/smarthome-apis.md |
Shelly Cloud, Tuya IoT, Philips Hue, IKEA Dirigera |
| Global / other | references/global-apis.md |
OpenAI, Spotify, Google Calendar, Telegram, GitHub |
Authentication Patterns at a Glance
| Pattern | How it works | Examples |
|---|---|---|
| API key in header | Authorization: Bearer {key} or X-API-Key: {key} |
Tibber, OpenAI |
| API key in URL | ?appid={key} appended to URL |
OpenWeatherMap |
| OAuth2 | Get access token first, refresh periodically | Spotify, Google |
| Local token | One-time press-button auth on device | Philips Hue |
| No auth | Public API, no credentials needed | SMHI, yr.no, Nordpool |
| Basic auth | Username + password Base64-encoded | Some local devices |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 127 lines · 132 tokens per session scan A b024586aae9d
API Catalog is a skill published in the GitHub repository tonylofgren/aurora-smart-home (104 stars, last pushed 4d ago), licensed MIT. It adds 132 tokens to every session and 1,191 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ha-esphome-binding-add
Wires one Home-Assistant-driven value or command into an ESPHome device per spec/ha/esphome-ha-driven-content — choosing the mechanism by the spec's rule (continuously mirrored value → state subscription, one-shot instruction → callable action, person-set value → writable template entity, something HA must learn →…
bat-story-eval
Compare MCP tool behavior between target and baseline versions using pre-built and custom stories with diff-based triage.
contrib-pr-review
Review a contribution PR for safety, quality, and readiness. Checks for security concerns, test coverage, size appropriateness, and intent alignment. Use when reviewing external contributions.
bat-adhoc
Run bot acceptance tests to validate MCP tools work correctly from a real AI agent's perspective. Use when testing PRs, detecting regressions, or verifying tool changes end-to-end with Claude/Gemini CLIs.
contributors-update
Find merged PR authors missing from README and update the contributors list after approval.
issue-to-pr-resolver
Implement a GitHub issue end-to-end — create a worktree branch, implement the feature with tests, create a draft PR, then iteratively resolve all CI failures and review comments until the PR is clean. Use when you need to fully implement a GitHub issue from start to merge-ready. Triggers on "implement issue", "resolve…