Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vyuh-labs/dxkit --skill dxkit-featuregit clone --depth 1 https://github.com/vyuh-labs/dxkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-feature)<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-feature"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-feature/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-feature"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-feature.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 11 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 66 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 70 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 77 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 80 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 119 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 133 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 164 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 165 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 166 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 172 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 221 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02723 |
| Opus 5.5 | $0.00000 | $0.01089 |
| Sonnet 5.5 | $0.00000 | $0.00545 |
| Haiku 4.5 | $0.00000 | $0.00272 |
Grade A, and why
dxkit-feature scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dxkit-feature
This skill drives forward development — building something new — the way
dxkit-action drives the reverse (fixing what's flagged). Its two jobs:
- Orient by graph, not by grep. Use the code graph to find where the feature plugs in, what patterns already exist, and what a change will touch — at a fraction of the tokens that repeated whole-file reads cost.
- Close the loop a plain coding agent skips. After the edit, run the dxkit analyzers on the change and the guardrail check, so the new feature doesn't quietly ship a vuln, a test gap, or a quality regression.
Defer to a repo-specific feature/architecture skill first
This skill is deliberately generic — it claims the broad "add a feature /
implement X" trigger. But many repos define their own skill for building a
module or feature (an /add-module, a platform architecture guide, a
domain-specific scaffolder) that encodes where code must live and what
contract it must satisfy in that codebase. When such a skill exists, it wins
on architecture: it decides the shape, the boundaries, the naming, the layering.
The two compose — they don't conflict:
- The repo skill owns the architecture contract — the "what and where."
- This skill owns the method — orient by graph instead of grep (step [2]), and verify the change didn't regress security/tests/quality before pushing (step [5]). Offer those as the layer that runs inside the repo's flow.
So when the user's request matches both, follow the repo-specific skill for the design decisions and fold this skill's orientation + verification steps into it — don't override the repo's conventions with the generic loop below. Only when the repo has no feature/architecture skill of its own does this skill drive the whole flow end to end.
The feature loop
[1] Clarify → what's the feature + what does "done" mean
[2] Orient → query the graph: where it lives, patterns, blast radius
[3] Plan → ordered edits, reusing the patterns found in [2]
[4] Build → read only the files the graph named, then implement
[5] Verify → run the analyzers on the change; confirm nothing regressed
[6] Decide baseline→ commit, or re-baseline if the change is deliberately accepted
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 223 lines · 0 tokens per session scan A dd097a6ea9ca
dxkit-feature is a skill published in the GitHub repository vyuh-labs/dxkit (10 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,723 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Code Coverage Analysis
Measure and enforce test coverage with Istanbul/nyc, c8, Jest, and Vitest. Covers branch versus line coverage, per-directory thresholds, CI gates, and correctly excluding generated code from reports.
specflow
Spec-driven development with executable contracts.
specflow-simulate
Simulates end-to-end usage of a Specflow story across multiple personas and divergent routes to discover gaps, edge cases, and unhandled branches BEFORE the story is built — then proposes each finding as a concrete story addition (new REQ, negative-path AC, Gherkin branch, or journey step). This is the high-value…
testing
This skill should be used when the user asks about "testing", "test coverage", "unit tests", "integration tests", "test organization", "test best practices", "flaky tests", "test isolation", "TDD", "regression tests", or needs guidance on test structure, coverage requirements, and test execution.
ci-rules
CI + hooks discipline — ci-test-memory-tuning (test-suite memory budget vs runner OS headroom; OOM vs worker-thrash diagnostic), github-actions-gotchas (named pitfalls: bash -e + pipefail, 21K char expression limit, SHA-pin actions, runner OOM, workerIdleMemoryLimit thrash, pullrequest vs pullrequesttarget), hooks…
sw-guard
Detects project stack and existing guardrails, then interactively configures deterministic quality checks across session, commit, push, and CI/CD layers.