Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xsolla/xsolla-ai-kit --skill shop-setupgit clone --depth 1 https://github.com/xsolla/xsolla-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xsolla/xsolla-ai-kit/shop-setup)<a href="https://agentmods.dev/skills/xsolla/xsolla-ai-kit/shop-setup"><img src="https://agentmods.dev/badge/skills/xsolla/xsolla-ai-kit/shop-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xsolla/xsolla-ai-kit/shop-setup"><img src="https://agentmods.dev/badge/skills/xsolla/xsolla-ai-kit/shop-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00218 | $0.03051 |
| Opus 5 | $0.00109 | $0.01525 |
| Sonnet 5 | $0.00044 | $0.00610 |
| Haiku 4.5 | $0.00022 | $0.00305 |
Grade A, and why
shop-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Xsolla Headless Shop — Architecture Overview
What is Headless Shop
A custom game store assembled from individual Xsolla products and integrated into the partner's own site with the help of AI. The partner writes the frontend; Xsolla provides backend services and SDKs.
Four components:
| Component | Role |
|---|---|
| Login | Player identity — authentication, JWT, social login, game ID binding |
| Store API | Commerce backend — catalog, cart, orders, promos, inventory, virtual currency |
| Headless Checkout SDK ⭐ | Embedded payment UI on the partner's site — recommended for Headless Store |
| Pay Station | Xsolla-hosted payment page — fallback when embedded UI is not needed |
Headless Checkout SDK (
github.com/xsolla/pay-station-sdk) is the recommended payment layer for this integration type. It renders the full payment UI directly on the partner's site without redirecting the player elsewhere — the natural fit when AI is already building the entire storefront. Pay Station redirect is a valid fallback but not the default choice here.
System Interaction (logical, not code)
Partner's site
│
├── Store API ──────────────────── catalog, cart, orders, promos, inventory
│ │
│ └── Login (JWT) ────────── authenticated cart, user balance, personal limits
│
└── Headless Checkout SDK ──────── embedded payment UI on partner's site
│
└── Webhook ────────────── partner's backend ← fulfillment trigger
Data flow for a purchase:
- Player browses catalog → Store API (no auth required)
- Player adds to cart → Store API (guest or JWT)
- Player logs in → Login issues JWT → cart switches to Bearer mode
- Checkout: Store API creates payment token → Headless Checkout SDK (or Pay Station) handles payment
- Payment confirmed → Xsolla sends webhook to partner's backend → partner grants item in game
Integration Phases
The agent builds bottom-up: data first, then identity, then payment.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 290 lines · 218 tokens per session scan A 8ce5c8402342
shop-setup is a skill published in the GitHub repository xsolla/xsolla-ai-kit (3 stars, last pushed 20d ago), licensed MIT. It adds 218 tokens to every session and 3,051 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hz-store-submit
Guides end-to-end Meta Quest and Horizon OS app submission to the Meta Horizon Store — build validation, store-readiness checks, asset preparation, upload, and submission tracking. Use when preparing a Quest app for store publishing.
roblox-gamepasses
Rule-accurate Roblox monetization — game passes, developer products (ProcessReceipt), and subscriptions (GetUserSubscriptionStatusAsync, PromptSubscriptionPurchase). Covers the selling flow, server-authoritative granting on PlayerAdded and purchase completion, PolicyService gating (ArePaidRandomItemsRestricted…
roblox-monetization
Use when implementing Roblox GamePasses, Developer Products, subscriptions, private servers, Creator Rewards, or purchase policy checks.
ai-hive-animation-167-e6ff654
An AI-HIVE workflow for creating original 8-bit pixel-art animation or game-oriented content. It covers characters, settings, storyboards, key frames, animation clips, and checks for visual consistency and originality.
implement-in-app-purchases
Implement, configure, and debug Unity In-App Purchases (IAP) — store connection, product catalog, consumable/non-consumable/subscription purchases, two-step pending-confirm flow, receipt validation, entitlement checking, restore transactions, Apple extensions (promotional purchases, Ask-to-Buy, code redemption), and…
portals-game-economy
Sell in-game products for Coins inside a hosted Portals web game with Portals.economy — microtransactions, IAP, durable and consumable SKUs, purchase confirmation, player inventory, and spending consumables. Use when working with Portals.economy.getCatalog, getInventory, purchase, consume, operationId idempotency, the…