Zerolang is an experimental programming language in which a semantic graph serves as the program database, allowing agents to query and submit checked structural edits. It is intended for agent-driven software development where the compiler validates changes before they are stored, while humans review readable text projections. The catalogue entries provide instructions and a skill for using Zerolang's graph and compiler workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vercel-labs/zerolang --skill zerogit clone --depth 1 https://github.com/vercel-labs/zerolangWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vercel-labs/zerolang/zero)<a href="https://agentmods.dev/skills/vercel-labs/zerolang/zero"><img src="https://agentmods.dev/badge/skills/vercel-labs/zerolang/zero/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vercel-labs/zerolang/zero"><img src="https://agentmods.dev/badge/skills/vercel-labs/zerolang/zero.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk fail
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 15 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.00927 |
| Opus 5.5 | $0.00006 | $0.00371 |
| Sonnet 5.5 | $0.00003 | $0.00185 |
| Haiku 4.5 | $0.00001 | $0.00093 |
Grade C, and why
zero scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
command -v zero >/dev/null 2>&1 || { curl -fsSL https://zerolang.ai/install.sh | bash; } Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
command -v zero >/dev/null 2>&1 || { curl -fsSL https://zerolang.ai/install.sh | bash; } How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Zero
Zero is an agent-first programming language. zero.graph is the program; .0 files are projections of it. Edit through zero patch.
Install this skill once in an agent's skill manager. Keep it thin; Zero's own CLI serves the version-matched workflow for each installed compiler.
Use the zero already on PATH or at ~/.zero/bin/zero when one exists; environments often pin a specific compiler, and replacing it silently breaks version-matched stores and workflows. Install only when zero is missing:
command -v zero >/dev/null 2>&1 || { curl -fsSL https://zerolang.ai/install.sh | bash; }
export PATH="$PATH:$HOME/.zero/bin"
zero --version
Version-Matched Skills
This file is only a discovery stub. Do not treat it as the full Zero workflow or as command reference.
Before editing, checking, testing, or repairing Zero code, ask the installed compiler for the skill content that matches that exact binary:
zero skills
zero skills get zero
zero skills get zero --full
zero skills get stdlib --topic std.time # one section instead of the whole topic
If the user has multiple Zero binaries, use the same binary that will run the project:
/path/to/zero skills
/path/to/zero skills get zero --full
Use zero skills get <name> to load only what the task needs, and fetch each
topic at most once per session: the content is fixed for a given compiler
binary, so refetching a loaded topic returns the same text. Topics and
approximate served sizes:
zero(~2 KB): this discovery stubagent(~4 KB): read-edit-verify loop, zero query usage, edit surfaces, verificationlanguage(~6 KB): syntax, types, effects, control flow, genericsgraph(~9 KB): zero.graph store, query/view, patch operations, import/export/mergediagnostics(~4 KB): reading diagnostics, zero explain, typed fix planspackages(~5 KB): manifests, package layout, creation and repairbuilds(~5 KB): build/run, targets, profiles, emitted artifactstesting(~3 KB): test blocks, filters, runtime checksstdlib(~39 KB): full signature reference, including ready-made validators:std.time(RFC 3339 incl. the exact leap-second rule),std.inet(IPv4/IPv6/hostname),std.regex(ECMA subset),std.unicode(strict UTF-8). Check here before hand-writing any parsing or validation logic. Fetch one module's section (~1 KB) withzero skills get stdlib --topic <prefix>, e.g.--topic std.time.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 74 lines · 14 tokens per session scan C c66ceac43509
zero is a skill published in the GitHub repository vercel-labs/zerolang (5,382 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 14 tokens to every session and 927 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
erlang-otp-behaviors
Use when oTP behaviors including genserver for stateful processes, genstatem for state machines, supervisors for fault tolerance, genevent for event handling, and building robust, production-ready Erlang applications with proven patterns.
omh-rust
This is an OMH rust workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
axiom-concurrency
Use when writing ANY async code, actors, or threads in an Apple-platform app, or seeing ANY concurrency error. Covers Swift 6 concurrency, @MainActor, Sendable, data races, async/await patterns.
haskell-pro
Expert Haskell engineer specializing in advanced type systems, pure functional design, and high-reliability software. Use PROACTIVELY for type-level programming, concurrency, and architecture guidance.
migrate-better-result-3
Migrate a TypeScript codebase from better-result 2.x to 3.0. Use when upgrading better-result across the TaggedError syntax, removed Result serialization helpers, recovery inference, matching, or retry APIs.
advpl-tlpp-sdd
Plan and implement Protheus projects/features with 4 adaptive phases — Specify, Design, Tasks, Execute. Auto-sizes depth based on complexity. Creates atomic tasks with verification criteria, atomic commits, requirement traceability, and persistent memory across sessions. Specific to AdvPL/TLPP + Protheus. Use when…