Vellum Assistant is a personal AI assistant that remembers information about users, learns their preferences, and takes actions across connected apps. It is intended for people who want an assistant that can manage conversations, unfinished work, and proactive notifications over time. The catalogue skills, hooks, instruction, and setting configure or extend how the assistant works.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vellum-ai/vellum-assistant --skill typescript-evalgit clone --depth 1 https://github.com/vellum-ai/vellum-assistantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vellum-ai/vellum-assistant/typescript-eval)<a href="https://agentmods.dev/skills/vellum-ai/vellum-assistant/typescript-eval"><img src="https://agentmods.dev/badge/skills/vellum-ai/vellum-assistant/typescript-eval.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 55 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 55 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.00430 |
| Opus 5 | $0.00007 | $0.00215 |
| Sonnet 5 | $0.00003 | $0.00086 |
| Haiku 4.5 | $0.00001 | $0.00043 |
Grade C, and why
typescript-eval scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
bash command="rm -rf /tmp/vellum-eval/" What it actually says
TypeScript Evaluation
When you need to test a TypeScript snippet before persisting it as a managed skill, use bash directly.
Workflow
1. Write the snippet to a temp file
bash command="mkdir -p /tmp/vellum-eval && cat > /tmp/vellum-eval/snippet.ts << 'SNIPPET_EOF'
<your code here>
SNIPPET_EOF"
2. Run it with bun
bash command="bun run /tmp/vellum-eval/snippet.ts" timeout_seconds=10
3. For function-based testing
If the snippet exports a default or run function, write a runner script:
bash command="cat > /tmp/vellum-eval/runner.ts << 'RUNNER_EOF'
import * as mod from './snippet.ts';
const fn = (mod as any).default ?? (mod as any).run;
const input = {}; // mock input
const result = await fn(input);
console.log(JSON.stringify(result, null, 2));
RUNNER_EOF"
Then run the runner:
bash command="bun run /tmp/vellum-eval/runner.ts" timeout_seconds=10
4. Clean up
bash command="rm -rf /tmp/vellum-eval/"
Guidelines
- Iteration limit: Max 3 attempts before asking the user for guidance.
- After successful test: Persist with
scaffold_managed_skillonly after explicit user consent. - Timeout: Use
timeout_seconds=10(or up to 20 for complex snippets). - Never persist or delete skills without explicit user confirmation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -1 lines fd5a1e8c4546
- 4d ago First seen · 65 lines · 14 tokens per session scan C d2cabfb07bbc
typescript-eval is a skill published in the GitHub repository vellum-ai/vellum-assistant (1,201 stars, last pushed yesterday), licensed MIT. It adds 14 tokens to every session and 430 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
tdd-workflow
Enforce practical Test-Driven Development for code changes in Go services. Use for new features, bug fixes, refactors, API changes, and new modules. Requires Red-Green-Refactor evidence, defect-hypothesis-driven tests, killer cases, and coverage gates (line + risk-path).
typescript-test-writing
Use this skill when writing or modifying tests in the llxprt-code repository. Covers mandatory TDD, behavioral testing, bun:test conventions and file naming, mock hygiene (no mock theater), and what never to test. Distilled from dev-docs/RULES.md, which remains the source of truth.
migrate-from-ai-sdk
Use when porting an app from the Vercel AI SDK (ai, @ai-sdk/) to @deuz-sdk/core. Triggers include "migrate from the AI SDK", "replace ai with @deuz-sdk/core", "we use streamText/generateText/useChat and want to switch", removing @ai-sdk/openai or @ai-sdk/anthropic, porting a toUIMessageStreamResponse route, converting…
plan-pipeline-execute
Execute a validated plan: worktree isolation, TDD scaffolding, level-based parallel agents, quality gate with smoke test, PR creation and merge. Handles everything through to merged PR.
ts-library
Use when authoring TypeScript libraries or npm packages - covers project setup, package.json exports, build tooling (tsdown/unbuild), API design patterns, type inference tricks, testing, and publishing to npm. Use when bundling, configuring dual CJS/ESM output, or setting up release workflows.
biome
Biome linter and formatter for JavaScript/TypeScript. Covers configuration, rules, and integration patterns. Replaces ESLint + Prettier for faster development experience. USE WHEN: user mentions "biome", "linting", "formatting", "code style", "biome.json", asks about "setup linter", "format code", "migrate from…