Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add YoungLeadersDotTech/young-leaders-tech-marketplace/plugin install skills-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/youngleadersdottech/young-leaders-tech-marketplace/skills-toolkit)<a href="https://agentmods.dev/skills/youngleadersdottech/young-leaders-tech-marketplace/skills-toolkit"><img src="https://agentmods.dev/badge/skills/youngleadersdottech/young-leaders-tech-marketplace/skills-toolkit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/youngleadersdottech/young-leaders-tech-marketplace/skills-toolkit"><img src="https://agentmods.dev/badge/skills/youngleadersdottech/young-leaders-tech-marketplace/skills-toolkit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01612 |
| Opus 5.5 | $0.00018 | $0.00645 |
| Sonnet 5.5 | $0.00009 | $0.00322 |
| Haiku 4.5 | $0.00005 | $0.00161 |
Grade A, and why
skills-toolkit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skills Toolkit
Author and validate SKILL.md files and agent .md files for this marketplace. Replaces the old skill-creator-agent, skill-validator-agent, agent-author, and agent-validator prose-based agents (retired 2026-07-12) and their 5 command wrappers.
When to use
- "create a skill", "new SKILL.md", "add an agent"
- "validate this skill", "check this agent"
- Before opening a PR that adds or changes a skill/agent in this marketplace
Design principle
The old agents asked the model to self-score a description 0-100 against a rubric, simulate PII regex mentally, and print a "6-Phase Validation" report that had drifted from its own real step count. None of that is verifiable. This skill instead:
- Runs
scripts/validate_skills.py- a real script, not a prompt - Relays its findings verbatim
- Never invents a PASS/FAIL verdict beyond what the script's exit code says
Task* protocol
TaskCreate "Gather requirements" -> mark in_progress immediately
TaskCreate "Draft SKILL.md content" -> blocked_by Gather requirements
TaskCreate "Run validate_skills.py" -> blocked_by Draft SKILL.md content
TaskCreate "Fix findings, re-run if FAIL" -> blocked_by Run validate_skills.py
TaskCreate "Write file, confirm with user" -> blocked_by Fix findings, re-run if FAIL
Creating a new skill
- Gather the skill's shape via
AskUserQuestionrather than open prose - at minimum, name (kebab-case), one-line purpose, and the tool set. Example block (adapt options to context):
For open-ended fields (skill name, one-line purpose, WHEN/WHEN NOT to trigger) that don't reduce to a short option list, ask directly in prose -{ "questions": [ { "question": "What tools does this skill need?", "header": "Tool set", "multiSelect": true, "options": [ {"label": "Read/Write/Edit", "description": "Reads and writes files directly"}, {"label": "Bash", "description": "Runs shell commands or scripts"}, {"label": "AskUserQuestion", "description": "Needs to ask the user structured questions mid-run"}, {"label": "Task* set", "description": "Tracks multi-step work with TaskCreate/TaskUpdate/TaskGet/TaskList"} ] } ] }AskUserQuestionfree-text entry covers this. Seereferences/askuserquestion-protocol.mdfor the full shape and when prose-only is fine. - Draft frontmatter:
--- name: <kebab-case-name> description: <WHEN it triggers>. <WHEN NOT>. Keep under 250 chars total. allowed-tools: - Read - ... version: 1.0.0 --- - Draft the body: a
## When to usesection, a workflow, and a## Task* protocolblock if the skill does multi-step work withTaskCreate/TaskUpdatein itsallowed-tools. - Write the file to
plugins/<plugin>/skills/<name>/SKILL.md. - Run validation (below) before telling the user it's done.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 140 lines · 46 tokens per session scan A 3e85373257b3
skills-toolkit is a skill published in the GitHub repository YoungLeadersDotTech/young-leaders-tech-marketplace (10 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 1,612 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sweet-index
Use when (re)indexing a Sweet Search project. Runs the full-profile indexer with GPU model prewarming (CoreML cascade on M3+, candle Metal on M1/M2, ORT CPU elsewhere), kills ORT CPU models during indexing to avoid memory contention, and rewarms them for query readiness on completion. Incremental runs under 20 files…
factory-db-migration
The operational discipline for running a destructive change against a production database — schema migrations, data backfills, one-shot RPCs, historical seed imports. Adjacent to factory-data-layer.md (schema design) and factory-deployment.md (where migrations execute in CI) — this skill is about the runbook around…
factory-api
API conventions for both server actions and tRPC builds. Covers the decision between them, per-mutation Zod input schemas, central router composition, pagination shape, multi-field search via Drizzle ilike + or(), mutation lifecycle hooks, conditional query enabling, stale-time defaults, error response shape and…
factory-auth
Auth and authorization conventions distilled across builds with three different auth stacks (Better Auth + orgs, Supabase Auth + RLS, Clerk). Covers the provider decision matrix, the unified wrapper interface (requireAuth / requireRole / withOrgContext), procedure tier stacking, session handling, OAuth callback…
factory-ci
CI and pull-request review conventions. One canonical .github/workflows/ci.yml is the merge gate (typecheck, lint, test, build, claude-review); branch protection's required-checks list matches the job list 1:1; anthropics/claude-code-action@v1 reviews every PR against the factory-pitfalls.md checklist as a required…
factory-data-layer
Database schema, ORM, and migration conventions across builds. Drizzle as default with domain-partitioned schema modules, shared timestamps helper, multi-tenancy keys with cascade delete, pgTableCreator prefixing, JSONB for flexible attributes, schema-derived type exports, polymorphic table patterns, ESLint Drizzle…