Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/webrenew/uniconnpx agentmods add skills/webrenew/unicon/docsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/webrenew/unicon/docs)<a href="https://agentmods.dev/skills/webrenew/unicon/docs"><img src="https://agentmods.dev/badge/skills/webrenew/unicon/docs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/webrenew/unicon/docs"><img src="https://agentmods.dev/badge/skills/webrenew/unicon/docs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 16 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Agent Snooping · line 161 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01330 |
| Opus 5.5 | $0.00046 | $0.00532 |
| Sonnet 5.5 | $0.00023 | $0.00266 |
| Haiku 4.5 | $0.00012 | $0.00133 |
Grade A, and why
unicon scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Unicon
Unicon is a unified icon library providing 19,000+ icons from 9 popular libraries. Unlike traditional npm packages that bundle thousands of icons, Unicon generates only the icons you need.
Quick Start
# Install CLI globally
npm install -g @webrenew/unicon
# Or use directly with npx
npx @webrenew/unicon search "dashboard"
Core Commands
| Command | Description |
|---|---|
unicon search <query> |
AI-powered semantic search |
unicon get <name> |
Get single icon to stdout or file |
unicon bundle |
Bundle multiple icons by category or query |
unicon init |
Create .uniconrc.json config |
unicon sync |
Regenerate all bundles from config |
unicon skill |
Install AI assistant skills for Claude, Cursor, Windsurf, etc. |
unicon skills |
List and download skills from the public registry |
Output Formats
| Format | Extension | Use Case |
|---|---|---|
react |
.tsx |
React/Next.js (default) |
vue |
.vue |
Vue 3 SFC |
svelte |
.svelte |
Svelte components |
svg |
.svg |
Raw SVG markup |
json |
.json |
Data/programmatic use |
Icon Sources
| Source | Icons | Description |
|---|---|---|
lucide |
1,900+ | Beautiful & consistent |
phosphor |
1,500+ | 6 weights available |
hugeicons |
1,800+ | Modern outlined icons |
heroicons |
292 | Tailwind Labs |
tabler |
4,600+ | Pixel-perfect stroke |
feather |
287 | Simple and clean |
remix |
2,800+ | Multiple categories |
simple-icons |
3,300+ | Brand logos |
iconoir |
1,600+ | Modern outlined icons |
Common Workflows
Add Icons to a React Project
# 1. Initialize config
unicon init
# 2. Search for icons you need
unicon search "navigation arrows"
# 3. Add bundle to config
unicon add nav --query "arrow chevron menu"
# 4. Generate components
unicon sync
# 5. Import and use
# import { ArrowRight, Menu } from "./src/icons/nav"
Get a Single Icon Quickly
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 180 lines · 116 tokens per session scan A 3d23208e847a
unicon is a skill published in the GitHub repository webrenew/unicon (16 stars, last pushed 13d ago), licensed MIT. It adds 116 tokens to every session and 1,330 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
flint-theme-author
Use when: creating, translating, refining, reviewing, or validating a custom Flint ThemeSpec from brand guidelines, websites, slide decks, publication references, design tokens, or an existing visual identity. Produce a reusable ThemeSpec JSON object for Flint Theme Lab without inventing fields or changing chart…
thesvg
Fetch brand SVG logos and cloud architecture icons (AWS, Azure, GCP) from theSVG. Use when the user asks for a brand logo, company icon, framework mark, service icon, or any "icon/logo for X" where X is a real brand or cloud service. Returns ready-to-use CDN URLs or raw SVG markup.
building-landing-home
Compose a product or documentation home page from the @lobehub/ui/awesome landing components: LandingHero, AgentSkillCard, LogoMarquee, LandingSection, BentoGrid/BentoCard, CodeShowcase, FeatureGrid, InstallBanner and FluidGradient. Covers page structure, the lobedocs homePage hook, router links, theming the accent…
b123d-modeling
Use this skill when asked to model, build, or modify a 3D part or assembly with build123d — from a text description, a technical drawing (image or PDF), dimensions in a spec, or an existing STEP/STL file.
Aesthetic Web Design
Apply professional, premium UI/UX design standards when building or styling web interfaces. Use this skill when the user asks to create a website, landing page, web app, dashboard, UI component, or any visual interface — or when they ask to make something look better, more professional, or more beautiful. Covers…
taste-soft
High-end visual design like a premium agency. Defines exact fonts, spacing, shadows, card structures, and animations that make a website feel expensive. Blocks common defaults that make AI designs look cheap or generic. Based on taste-skill by Leon Lin & blueemi, improved by shokunin.