Borrowing it
Nothing to install: this file belongs to vorn-run/vorn. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vorn-run/vorn/main/.claude/skills/vorn-extension-author/SKILL.mdgit clone --depth 1 https://github.com/vorn-run/vornWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vorn-run/vorn/vorn-extension-author)<a href="https://agentmods.dev/skills/vorn-run/vorn/vorn-extension-author"><img src="https://agentmods.dev/badge/skills/vorn-run/vorn/vorn-extension-author/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vorn-run/vorn/vorn-extension-author"><img src="https://agentmods.dev/badge/skills/vorn-run/vorn/vorn-extension-author.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00670 |
| Opus 5.5 | $0.00025 | $0.00268 |
| Sonnet 5.5 | $0.00013 | $0.00134 |
| Haiku 4.5 | $0.00006 | $0.00067 |
Grade A, and why
vorn-extension-author scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Writing a Vorn extension
Read docs/extensions.md first, then docs/wasm-extensions.md for
components and the element tree. The API is defined once, in
packages/core/crates/extensions/wit/extension.wit.
The rules
- One API,
vorn:[email protected]. Never add another api id. Every manifest setsapi = "vorn:[email protected]";vorn = ">=1.0"is optional and is a range of API versions, not of Vorn releases. - Public only. An extension, Vorn's own included, calls only the
methods in
CORE_METHODS(gate.rs) and listens only toCORE_EVENTS(events.rs), each under the permission its manifest declares. If it needs something the API cannot do, add it to the API (WIT,gate.rs, docs), never a private path. - A built-in builds on
vorn-extension-sdkalone. No other path dependency, novorn_extension_sdk::bindingsor::guest. An exception goes inpackages/core/freeze.tomlwith a one-line reason. - The core stays frozen. A new place where a core or host crate names a
built-in (its id, its crate or its vornd module) fails
cargo test -p vorn-extensions --test freezeuntil it is listed infreeze.tomlunder[exceptions.hooks]with a reason. Prefer moving the behaviour behind the public API. - Versioning. A minor version only adds. Changing or removing anything
is a major: bump the WIT package,
wit/stdio.json(VORN_UPDATE_WIT=1 cargo test -p vorn-extensions publishes_the_mapping) and every manifest, and say so in the PR. - Handshake. A program checks
guest.init'sctx.apiand refuses a Vorn older than it was built for with a message naming both versions; a component is checked by vornd before linking. - Own workflows only. Seeded workflow ids and unseed prefixes start
with
<extension id>:, andworkflow.runruns only those. Running another's workflow, or seeding a script, agent or undeclared step, needsprocess.run.
Checks
cargo test --profile ci -p vorn-extensions --test freeze
cargo test --profile ci -p vorn-extensions --lib compat
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +1 tokens per session b96f54e7a55a
- 7d ago First seen · 51 lines · 62 tokens per session scan A f57ced86d6d7
vorn-extension-author is a skill published in the GitHub repository vorn-run/vorn (25 stars, last pushed today), licensed MIT. It adds 63 tokens to every session and 670 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-22.
Other skills, from other repositories
taiwanese-mandarin-translate
Translate English into Traditional Chinese for Taiwan audiences, using natural Taiwanese Mandarin by default and a neutral ROC Mandarin register when the context is formal or public-facing.
html-ppt-hermes-cyber-terminal
OpenDesign + BYOK: choosing and wiring your own model, hands-on — cost, quality, and the routing decision. Built as a decision-grade AI literacy deck for engineers, IT, applied-AI teams.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
threejs-textures
Three.js textures - texture types, UV mapping, environment maps, texture settings. Use when working with images, UV coordinates, cubemaps, HDR environments, or texture optimization.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
specflow-use
To connect Rosetta with Grid Dynamics SpecFlow MCP; only when SpecFlow is mentioned and the MCP is installed.