Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/hexbee/dsh-skill-panel/agents-mdgit clone --depth 1 https://github.com/hexbee/dsh-skill-panelWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00600 | $0.00600 |
| Opus 5 | $0.00300 | $0.00300 |
| Sonnet 5 | $0.00120 | $0.00120 |
| Haiku 4.5 | $0.00060 | $0.00060 |
Grade A, and why
dsh-skill-panel AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 28 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Standing orders for this repository. The product contract lives in README.md; these rules govern how the repo is changed.
Layout
src/— TypeScript source.src/index.tsis the host plugin (the/skill-panelConnection RPC channel);src/catalog.tsis the pure filesystem catalog;src/contract.tsis the shared wire contract both halves use;src/client/is the browser half (settings section + locales + styles).lib/— committed build artifacts. The harness profile resolvesmain,./client, and./invariantfrom here; every source change that should be installable must rebuild and commitlib/in the same commit.tests/—node --testsuites importing the catalog source directly.
Build and checks
pnpm run typecheck,pnpm run build, andnode --test tests/catalog.test.mjsmust all be green before a commit claims completion.yamlMUST stay external in the host ESM build (hostExternalin build.mjs): bundling it leavesrequire("process")dynamic requires in the ESM entry and the loader refuses to import the plugin, failing the whole tree at boot. The client build never includes yaml.- Before declaring a change installable, import the built
lib/index.jsandlib/invariant.jsthrough theirfile://URLs from a neutral cwd (exactly the loader's path) and exercise the overview endpoint with the stub cordis context. - The catalog is pure node:fs code and unit-tested (frontmatter acceptance, directory/flat discovery, symlink following, read/remove).
Wire discipline
- The client never submits a raw filesystem path: project scopes are workspace ids resolved Host-side; skill mutations are addressed by a name inside one of the two managed roots.
- The channel returns only codes from the closed RpcErrorCode union the browser Connection carrier validates:
bad-request({issues: []}),workspace-not-found({workspaceId}),command-error({}),internal({}).
Integration
- The plugin mounts into a dsh profile via
dsh plugin --profile <name> add file:/path/to/dsh-skill-panel(bundle route). Itsdsh.bundle.patchinserts one row; the profile's healednode_modulesresolves the bare name. - Host plugin-set changes take effect on server restart; client bundle changes are served from
lib/client.jsafter a rebuild (page refresh). - The harness checkout that feeds type checking is the installed profile (
link:devDependencies into~/.dsh/profiles/node_modules). When that snapshot moves, re-runpnpm install,pnpm run build, and fix API drift before integrating.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 28 lines · 600 tokens per session scan A 28fca5c5b175
dsh-skill-panel AGENTS.md is an instructions file published in the GitHub repository hexbee/dsh-skill-panel (2 stars, last pushed 19d ago), licensed MIT. It adds 600 tokens to every session, about $0.0030 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
dsh-TUI AGENTS.md
AGENTS.md instructions for ccch1mneyyy/dsh-TUI, covering agents.md, 仓库布局, 命令, 上游边界与契约 and 约定与红线.
dsh-worktable AGENTS.md
Instructions for Aisland-SJL/dsh-worktable, covering dsh-worktable 项目规则, 协作方式(用户定案,最高优先级), 边界, 构建与验证 and 领域约定(会话中必须遵守).
awesome-deepseek-harness-plugins AGENTS.md
Instructions for imsai-sh/awesome-deepseek-harness-plugins, covering repository instructions, the submission gate is the product, generated files, cross-repo contracts (no ci spans both repositories) and permanent urls.
dsh-launcher AGENTS.md
Instructions for Ruler4396/dsh-launcher, covering agents.md — 对本仓库中所有 ai agent 的强制指示, 🚨 第一优先:架构铁律(不读就动代码 = 违规), 🔥 快速合规清单(动代码前自检), 🧭 项目地图(定位代码) and ✅ 完成后必须自查.
iPolloWork AGENTS.md
AGENTS.md instructions for Devin-AXIS/iPolloWork, covering agents.md, what ipollowork is, core philosophy, pull request expectations (fast merge) and validate every experience.
dsh-mcp-panel AGENTS.md
Instructions for PerryLink/dsh-mcp-panel, covering agents.md, layout, hard rules applied here, config and build.