Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vyuh-labs/dxkit --skill dxkit-schemagit clone --depth 1 https://github.com/vyuh-labs/dxkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-schema)<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-schema"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-schema/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-schema"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-schema.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 22 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 31 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 39 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 51 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01825 |
| Opus 5.5 | $0.00046 | $0.00730 |
| Sonnet 5.5 | $0.00023 | $0.00365 |
| Haiku 4.5 | $0.00012 | $0.00183 |
Grade A, and why
dxkit-schema scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dxkit-schema
This skill owns the model-schema drift gate: dxkit statically extracts every declared data model (ORM entities, tagged structs, spec schemas) and fails a PR that changes one in a breaking way — a removed field, a changed type, an optional field made required, a removed model. Additive changes surface as warnings or information, never blocks.
It is thin orchestration over the deterministic CLI. It never re-implements extraction or diffing: it runs schema / schema diff / guardrail check, reads their structured output, and supplies judgment + code edits. The determinism stays in the CLI; the agent supplies the reasoning.
Language coverage. Recognition is marker-based per language pack — precision over recall. TypeScript/JavaScript: decorator-marked entity classes (TypeORM/MikroORM @Entity, sequelize-typescript @Table, NestJS-mongoose @Schema, type-graphql @ObjectType/@InputType) plus BaseEntity heritage; field facts from the type annotations. Python: Django models.Model, SQLAlchemy Base/DeclarativeBase, pydantic BaseModel, SQLModel, and @dataclass; Django/SQLAlchemy field constructors supply types and null=/nullable= optionality. Go: a struct tagged json:/gorm:/db:/bson: IS a wire contract; the tag supplies the wire name, omitempty and pointer types read as optional. Java: JPA @Entity/@Table/@Embeddable/@MappedSuperclass classes; @Column(nullable = …) supplies optionality and name = … the wire name — an unannotated column is an honest unknown (JPA defaults to nullable; dxkit never fabricates required). Kotlin: JPA annotations, kotlinx @Serializable data classes (incl. positional @SerialName("wire") names), and Exposed Table objects (fluent column chains — varchar("x", 50).nullable() reads type + optionality); String? nullability is read from the grammar, @Column overrides it. C#: [Table]/[Keyless]/[Owned] entities AND classes referenced by a DbContext's DbSet<T> properties; partial-class declarations assemble into one entity (codegen splits are never drift); string? NRT annotations supply optionality, positional [Column("x")]/[JsonPropertyName("x")] the wire names. Ruby (Rails): db/schema.rb is the model source — one entity per create_table, named by the TABLE (the wire contract), null: false ⇒ required and absence ⇒ nullable (the Rails default); the ActiveRecord class marker is discovery-only while a schema file exists. Rust: #[derive(Serialize/Deserialize)] structs; Option<T> optionality is precise, #[serde(rename = "x")] supplies wire names (rename_all/default container attributes are not read). Any other language — and unmarked DTOs in covered languages — participate via a spec: point .dxkit/policy.json:schema.specs at an OpenAPI (components.schemas) or JSON Schema document and its models are gated identically, no pack extraction needed.
What the gate does not see (tell the user honestly when relevant): unmarked plain interfaces/classes; dynamically-built schemas (disclosed in the inventory's dynamic list, not diffable); constraint-level changes (max length, enum members, validation rules, defaults); a type alias whose underlying type changed (comparison is lexical — resolving aliases would need a type-checker); serialization renames outside Go tags; migration files / raw SQL; whether anything actually consumes a removed field.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 75 lines · 116 tokens per session scan A 135b279b46b2
dxkit-schema is a skill published in the GitHub repository vyuh-labs/dxkit (10 stars, last pushed 1mo ago), licensed MIT. It adds 116 tokens to every session and 1,825 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
habit-hooks-prompting
Write or revise a habit-hooks coaching prompt. Use when a linter / knip / jscpd rule fires and the agent's default fix is wrong or shallow, or when adding a project-local override prompt. Keeps prompts short and outcome-focused using the ROSE pattern.
prompt-optimization
Applies prompt repetition to improve accuracy for non-reasoning LLMs. Use when a Haiku or other non-reasoning agent misses details in a long prompt.
mlops-patterns
Principal-level MLOps — feature stores, model registry, training pipelines, deployment patterns (online / batch / streaming), monitoring (drift, performance, fairness), CI/CD for models, A/B testing, rollback discipline. Treat models as software artefacts with full lifecycle management.
temps-mcp-setup
Configure Temps as an MCP (Model Context Protocol) server so AI assistants can interact with a Temps instance directly -- listing/inspecting projects and deployments, and (when write mode is enabled) triggering deployments with human confirmation. Use when the user wants to: (1) Set up the Temps MCP server, (2)…
ring:adopting-lib-commons-huma-wrapper
Adopting the lib-commons/v5 shared Huma (OAS 3.1) OpenAPI wrapper + RFC 9457 problem model (commons/net/http/{openapi,problem}) in a Lerian Go service: wire openapi.New/ServeSpec + problem.Install (central >=500 scrub) on BOTH runtime and spec-gen paths, the per-rail problem.MapError flex seam, and rename-only spec…
architecture-paradigm-pipeline
Applies pipes-and-filters for sequential data transformations. Use when data flows through discrete stages like ETL, streaming analytics, or CI/CD pipelines.