Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/transloadit/node-sdk/releasenpx skills add transloadit/node-sdk --skill releasegit clone --depth 1 https://github.com/transloadit/node-sdkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00022 | $0.01518 |
| Opus 5 | $0.00011 | $0.00759 |
| Sonnet 5 | $0.00004 | $0.00304 |
| Haiku 4.5 | $0.00002 | $0.00152 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release Checklist
-
Update local state:
git checkout main && git pullgit status --porcelain=v1(must be clean)
-
Prepare a code PR (feature/fix changes):
- Create branch from
main - Make changes
- If you touched
packages/node(or anything that affects the legacytransloaditclone):- Run
corepack yarn check(this may reformat files and/or auto-fix Knip findings) - Run
corepack yarn verify:fulllocally once before pushing.- This catches wrapper sync drift early and still runs the deeper repo checks.
- If
verify/verify:fullfails with transloadit wrapper drift, runnode scripts/prepare-transloadit.ts, commit the trackedpackages/transloaditupdates, and re-runcorepack yarn verify:full.
- Run
- If you add a changeset for
@transloadit/node, also add a similar changeset for@transloadit/mcp-serverif it could affect its workings. The chances are, they are, since the latter is mostly a thin wrapper around the former.- This repo enforces a one-way coupling: node releases should also publish a new mcp-server version (but mcp-server releases do not require node releases).
yarn check/yarn verifywill fail fast if you forget.
- Commit + push branch
- Open PR, wait for CI green
- Squash-merge the PR
Notes:
- When creating PRs with
gh pr createfrom a shell, avoid unescaped backticks in the--bodystring. Prefer--body-fileto prevent accidental command substitution. - If you use
gh run watchheavily, GitHub may throttle with HTTP 429. Prefergh pr checks <PR_NUMBER>with occasional polling (or use the web UI) if you hit throttling.
Optional parity playbook (release/debug only):
- Update the parity baseline:
node scripts/prepare-transloadit.tsnode scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.jsoncp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.json
- Immediately reformat the baseline:
corepack yarn fix:js
- Run
corepack yarn parity:transloadit - Commit + push if you intentionally want to update the recorded baseline
- Create branch from
-
Merge the "Version Packages" PR (changesets action):
- Wait for the
Version PackagesPR to appear (or update) - Checkout that branch locally:
git fetch origin changeset-release/maingit checkout changeset-release/main
- Ensure
yarn.lockis up to date (CI will fail otherwise):corepack yarn- If
yarn.lockchanged:git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push
- Verify the Version Packages PR includes all expected linked/versioned packages:
- Read the
# Releasessection (this is the authoritative "what will publish") - If you expect a linked package to bump (e.g.
@transloadit/nodeandtransloadit), ensure the PR updates both. If it doesn't, fix before merging (otherwise tags/releases can drift).
- Read the
- Ensure CI is green for the PR
- Squash-merge the PR
Notes:
- The Version Packages PR may show no required checks in the PR UI in some setups; verify by checking recent runs:
gh run list --branch changeset-release/main --limit 3
- Wait for the
-
Immediately after merging the Version Packages PR:
git checkout main && git pull- Update the lockfile (required for the Release workflow):
corepack yarn- If
yarn.lockchanged:git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push - Reason: the Release workflow runs
corepack yarnwith immutable installs and will fail if it would modifyyarn.lock.
- Run
corepack yarn check(catches formatting/knip/ts/unit drift early)
-
Prevent the
packages/transloaditclone from drifting (special case):- If the
transloaditpackage exists in this repo, keep it in sync with@transloadit/nodeby running:git checkout main && git pullnode scripts/prepare-transloadit.ts- Refresh parity baselines (if they changed):
node scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.jsoncp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.json
corepack yarn check- If anything changed, commit + push to
main
- If the
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 100 lines · 22 tokens per session scan A 6e1ecf94ec8d
release is a skill published in the GitHub repository transloadit/node-sdk (73 stars, last pushed 2d ago), licensed MIT. It adds 22 tokens to every session and 1,518 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
netsuite-sdf-safe-guide
Comprehensive NetSuite SDF best practices based on the SAFE Guide (12 principles + appendices). Generates Object XML for all 14 script types, enforces governance limits, security patterns, and defensive coding. Includes N/cache, N/query, concurrency limits, OAuth 2.0 guidance, legacy TBA guardrails, CustomTool runtime…
netsuite-suitescript-upgrade
SuiteScript 1.0, 2.0, and 2.x to 2.1 migration assistant. Analyzes, converts, explains, and validates script upgrades. Covers 125+ API mappings, 34 object conversions, 13 unmapped API workarounds, all script type entry point changes, SuiteScript 2.0/2.x to 2.1 upgrade guidance, and 16 categories of breaking behavioral…
netsuite-suitescript-learning
Interactive learning system for NetSuite SDF development. Features six modes (learn, review, explain, annotate, quiz, and final) with SAFE Guide integration. Produces compliance-reviewed learning documentation. Learn topics like governance, N/cache, and security directly from SAFE Guide principles. Generate quizzes…
netsuite-uif-spa-reference
Use when building, modifying, or debugging NetSuite UIF SPA components. Provides API/type lookup for @uif-js/core and @uif-js/component (constructors, methods, props, enums, hooks, and component options).
provable-sdk-tutorial-docs
Use when writing tutorial documentation or create-leo-app examples for the Provable SDK (@provablehq/sdk). Covers how to structure runnable templates, write tutorial-style docs, and handle Node.js vs web runtime differences.
netsuite-ai-connector-instructions
NetSuite Intelligence skill — teaches AI the correct tool selection order, output formatting, domain knowledge, multi-subsidiary and currency handling, and SuiteQL safety checklist for any AI + NetSuite AI Service Connector session.