Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vyuh-labs/dxkit --skill dxkit-actiongit clone --depth 1 https://github.com/vyuh-labs/dxkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-action)<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-action"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-action.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00201 | $0.06741 |
| Opus 5 | $0.00101 | $0.03370 |
| Sonnet 5 | $0.00040 | $0.01348 |
| Haiku 4.5 | $0.00020 | $0.00674 |
Grade A, and why
dxkit-action scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 405 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dxkit-action
This skill takes a dxkit report and drives the fix loop with the user. Reach for it after dxkit-reports has surfaced concrete findings.
Cleaning the BASELINE (grandfathered debt): start from debt
For a whole-baseline cleanup pass — the deployment where the gates are armed and your job is to burn down what they grandfathered — start from the composed inventory instead of a single report:
npx vyuh-dxkit debt --json
It returns one priority-ordered plan across BOTH debt classes:
- Correctness-floor debt (broken build, failing tests) — live-run, with
the reproduction command and captured error output per failing check, and
provenance vs the baseline's
floorDebtenvelope (failing since baseline= the debt you're here to fix;new since baseline= the gate's business, it already blocks). Fix the build first — until it compiles, nothing else is reliably measurable. - Finding debt (secrets, CVEs, SAST, lint backlog) — fingerprinted baseline entries grouped by severity; drive each group with the scoped action loop below.
The command is informational and always exits 0 — the gates do the blocking,
and they also hold the ratchet: once you fix a floor check, any regression is
net-new and blocks automatically. No re-baselining is needed for floor fixes;
finding fixes surface as removed on the next check and leave the baseline
on the next re-capture.
The action loop
[1] Read the report → understand what's flagged
[2] Prioritize → severity + reachability + blast radius + cost
[3] Plan → ordered list of edits
[4] Execute → fix one finding at a time
[5] Verify → re-run the analyzer, confirm score moved
[6] Decide on baseline → commit fix or accept-as-baseline
Don't skip [5]. Re-running the analyzer is the only way to confirm the fix landed correctly.
For the richest input, read the detailed report with graph context attached:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 405 lines · 201 tokens per session scan A a98a7e82cb2a
dxkit-action is a skill published in the GitHub repository vyuh-labs/dxkit (10 stars, last pushed 9d ago), licensed MIT. It adds 201 tokens to every session and 6,741 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
chrome-cdp
Drive a headless Chrome over the Chrome DevTools Protocol (CDP) for browser QA — navigate, click, fill forms, read the DOM/accessibility tree, screenshot, and assert. Use whenever a task requires loading a web page and interacting with it like a user. Chrome is launched by a bash step (recipe below); this skill…
software-code-refactoring
Improve production code quality while preserving all existing test behavior. Commonly used for the Refactor phase of TDD red-green-refactor, but applicable to any codebase with tests. Use when production code works but needs cleanup — reducing duplication, improving naming, simplifying complexity, aligning with…
brooks-health
Combined codebase health dashboard that scores a project across all four quality dimensions — PR quality, architecture, tech debt, and test quality — in a single pass, drawing on twelve classic engineering books. Triggers when: user wants an overall quality assessment, asks "how healthy is this codebase?", "run all…
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
check
Confirm a change before merge. /check verify drives the real app to prove behavior against the spec (every acceptance criterion met, every surface built). /check review runs a senior code review on a fresh model, one that did not write the code. Verify after /develop, review before a PR. Writes to docs/reviews/, never…
habit-hooks-review
Spawn a reviewer sub-agent to assess a change set against habit-hooks's coding principles. Use AFTER habit-hooks reports clean — habit-hooks catches structural smells; this catches what it cannot (correctness, tests, design, missed edge cases).