Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add YuDefine/nuxt-supabase-starter --skill commitgit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/commit)<a href="https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/commit"><img src="https://agentmods.dev/badge/skills/yudefine/nuxt-supabase-starter/commit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/commit"><img src="https://agentmods.dev/badge/skills/yudefine/nuxt-supabase-starter/commit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 104 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 368 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 368 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.00601 |
| Opus 5.5 | $0.00032 | $0.00240 |
| Sonnet 5.5 | $0.00016 | $0.00120 |
| Haiku 4.5 | $0.00008 | $0.00060 |
Grade A, and why
commit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
User Input
$ARGUMENTS
SOP
照順序走;每步條件成立才讀該條判準,讀完照做。
- 0-Batch|READ 若進入
/commit(每次),讀取rules/批次入口判準.md,先跑wt-helper batch status。 - 0-Lock|READ 若要進品質流程,讀取
rules/鎖與退出判準.mdRule 1 取鎖。 - 0-Coord→0-Transport→0-Scope→0-MR|READ 若已持鎖,讀取
rules/前置探測判準.md。 - Step 0|READ 若候選已定,讀取
rules/品質檢查判準.md,跑 0-A~0-F。 - Step 1|READ 若品質檢查已過(每次),讀取
rules/schema觸發判準.md跑觸發判定。 - Step 2–4|READ 若要分組提交,讀取
rules/分組與提交判準.md。 - Step 5|READ 若分組 commit 完成,讀取
rules/交接判準.md。 - Step 6-Gate|READ 若已 land 要進發版,讀取
rules/發版授權判準.md,跑deploy-trigger-check.ts。 - Step 6-A|READ 若
verdict=confirmed-push-main,讀取rules/push-main發版判準.md。 - Step 6-B|READ 若
verdict=needs-approval或腳本不存在,讀取rules/停在push-main判準.md。 - Step 6b|READ 若 tag 已推出,讀取
rules/Notion同步判準.md。 - Step 7–8|READ 若要出完成報告,讀取
rules/完成報告判準.md。 - Final|READ 若要退出(完成、gate 失敗、中止皆同),讀取
rules/鎖與退出判準.mdRule 2 釋放鎖。
What ships with it
34 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- batch.md 29 KB
- gates.md 87 KB
- handoff-steps.md 5.4 KB
- release-push.md 16 KB
- review-policy.md 9.2 KB
- rules/Notion同步判準.md 2.5 KB
- rules/push-main發版判準.md 6.0 KB
- rules/review-tiers.md 4.9 KB
- rules/schema觸發判準.md 4.9 KB
- rules/security-policy.md 2.4 KB
- rules/交接判準.md 3.6 KB
- rules/停在push-main判準.md 5.3 KB
- rules/分組與提交判準.md 10 KB
- rules/前置探測判準.md 6.7 KB
- rules/品質檢查判準.md 7.9 KB
- rules/完成報告判準.md 5.8 KB
- rules/批次入口判準.md 4.0 KB
- rules/發版授權判準.md 4.1 KB
- rules/鎖與退出判準.md 2.6 KB
- runner-safety.md 14 KB
- runtime-gates.md 6.6 KB
- runtime-lifecycle.md 10 KB
- schema-sync.md 8.8 KB
- scripts/0a-metrics.mjs 16 KB runs code
- scripts/claude-review-safe.sh 60 KB runs code
- scripts/codex-review-safe.sh 13 KB runs code
- scripts/commit-lock.mjs 40 KB runs code
- scripts/lib/lockfile-dep-summary.mjs 15 KB runs code
- scripts/lib/projection-exemption.ts 24 KB runs code
- scripts/lib/review-common.sh 86 KB runs code
- scripts/lib/review-subagent-transcript.mjs 15 KB runs code
- scripts/lib/review-subagent.sh 16 KB runs code
- scripts/lib/review-verdict.ts 1005 B runs code
- security-scan.md 14 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · -1 lines c838927c437e
- 12d ago Changed · -573 lines · +1 tokens per session 5950440b5f42
- 23d ago Changed de115e5f67b9
- 25d ago Changed · +21 lines 26aa1bfad2ed
- 25d ago Changed · +4 lines 3c9dada00d91
- 26d ago Changed 1d142a2c8c8b
- 27d ago Changed · +11 lines eebf500fea58
- 1mo ago Changed 4483e5b5207e
- 1mo ago Changed · -4 lines 1fd1fd50509f
- 1mo ago First seen · 581 lines · 79 tokens per session scan A 481fa4209ca0
commit is a skill published in the GitHub repository YuDefine/nuxt-supabase-starter (44 stars, last pushed yesterday), licensed MIT. It adds 80 tokens to every session and 601 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nw-finalize
Archives a completed feature to docs/evolution/, migrates lasting artifacts to permanent directories, and cleans up the temporary workspace. Use after all implementation steps pass and mutation testing completes.
nw-hotspot
Git change frequency hotspot analysis — find the most-changed files in your codebase.
shipping-and-launch
Pre-deploy hygiene for a Spring Boot 4 feature — verify gates, capture rollback plan, sign off observability, generate release notes, and stage the rollout. Used by /ship after /review approves the diff. The agent never deploys; it produces the plan a human executes.
prd-v07-test-planning
Define test cases BEFORE implementation, ensuring every API, business rule, and user journey has verifiable acceptance criteria during PRD v0.7 Build Execution. Triggers on requests to define tests, plan test coverage, create test cases, or when user asks "define tests", "test planning", "what to test?", "test cases"…
tp-merge-from-main
Sync a base branch INTO a design's worktree (base-sync) and auto-resolve the safe living-doc conflict classes behind a zero-drop verifier, deferring everything semantic to the human. Re-runs tests, re-pushes only when green, updates the PR. This is the reversible base-into-branch operation — landing the PR is the…
tp-pr-iterate
Autonomous PR-iteration loop driver — poll review comments, classify (heuristic + Sonnet), defer conflicting structural fixes, dispatch to tp-pr-fix per round, reply-and-resolve every thread, apply caps + guards, and terminate only at two-stable: both review sources quiet AND zero unresolved actionable threads…