Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/iflytek/skillhub/agents-mdgit clone --depth 1 https://github.com/iflytek/skillhubWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.06853 | $0.06853 |
| Opus 5 | $0.03426 | $0.03426 |
| Sonnet 5 | $0.01371 | $0.01371 |
| Haiku 4.5 | $0.00685 | $0.00685 |
Grade A, and why
skillhub AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 600 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SkillHub — AGENTS.md
SkillHub is an enterprise-grade, self-hosted agent skill registry for publishing, discovering, and managing reusable skill packages across an organization. It provides a REST API backend, a React web UI, a security scanner, and a ClawHub CLI compatibility layer.
Quick Reference
| Item | Value |
|---|---|
| Backend | Spring Boot 3.2.3, Java 21, Maven multi-module (7 modules) |
| Frontend | React 19, TypeScript, Vite, pnpm |
| Scanner | Python (FastAPI), port 8000 |
| Database | PostgreSQL 16 (Flyway migrations) |
| Cache | Redis 7 (sessions, distributed locks, idempotency) |
| Storage | LocalFile (dev) / S3/MinIO (prod) |
| Build | make dev-all (dev), make staging (pre-PR) |
| Docs | docs/ (design), document/ (VitePress user guide) |
| CI | GitHub Actions (.github/workflows/) |
Directory Map
skillhub/
├── server/ # Maven multi-module Spring Boot backend
│ ├── skillhub-app/ # Application layer: bootstrap, controllers, assembly
│ │ ├── bootstrap/ # Bootstrap admin & local dev data initializers
│ │ ├── compat/ # ClawHub CLI compatibility layer controllers
│ │ ├── config/ # Spring configuration classes
│ │ ├── controller/ # REST controllers (transport only)
│ │ │ ├── admin/ # Admin controllers (user mgmt, labels, search)
│ │ │ ├── portal/ # Portal controllers (skills, governance, security)
│ │ │ └── support/ # Package extractors (zip, multipart)
│ │ ├── dto/ # Request/response DTOs
│ │ ├── exception/ # Exception handling
│ │ ├── filter/ # Servlet filters (auth context, rate limiting)
│ │ ├── listener/ # Event listeners (notification recipients, etc.)
│ │ ├── metrics/ # Micrometer metrics
│ │ ├── projection/ # Lifecycle projection models
│ │ ├── ratelimit/ # Rate limiting logic
│ │ ├── repository/ # Query repositories (read-model assembly)
│ │ ├── security/ # Security configuration
│ │ ├── service/ # App services (workflow orchestration)
│ │ ├── stream/ # SSE streaming endpoints
│ │ ├── task/ # Background task scheduling
│ │ └── SkillhubApplication.java # Spring Boot entry point
│ │
│ ├── skillhub-domain/ # Domain layer: entities, rules, services (innermost)
│ │ ├── audit/ # AuditLog entity, repository, service
│ │ ├── auth/ # Password reset entities
│ │ ├── event/ # Domain event classes (SkillPublishedEvent, etc.)
│ │ ├── governance/ # Governance notification service
│ │ ├── idempotency/ # Idempotency records
│ │ ├── label/ # Skill label management
│ │ ├── namespace/ # Namespace, members, roles, policies
│ │ ├── report/ # Skill reporting/governance
│ │ ├── review/ # Review tasks, promotion requests
│ │ ├── security/ # Security scanning domain model
│ │ ├── shared/ # Shared domain utilities
│ │ │ └── exception/ # Domain exceptions (LocalizedDomainException, etc.)
│ │ ├── skill/ # Core skill entities and services
│ │ │ ├── metadata/ # SKILL.md frontmatter parsing
│ │ │ ├── service/ # Skill domain services (publish, query, governance)
│ │ │ └── validation/ # Package validation (SkillPackagePolicy, etc.)
│ │ ├── social/ # Star, rating, subscription entities
│ │ └── user/ # UserAccount, profile moderation
│ │
│ ├── skillhub-auth/ # Authentication & authorization
│ │ ├── config/ # Spring Security configuration
│ │ ├── device/ # OAuth Device Flow for CLI auth
│ │ ├── identity/ # Identity binding service
│ │ ├── local/ # Local (password) auth
│ │ ├── merge/ # Account merging
│ │ ├── oauth/ # OAuth2 login handlers
│ │ ├── policy/ # Route security policies
│ │ ├── rbac/ # RBAC service and role definitions
│ │ ├── token/ # API token management
│ │ └── user/ # User-related auth services
│ │
│ ├── skillhub-search/ # Search SPI + PostgreSQL full-text implementation
│ │ ├── postgres/ # PostgresFullTextIndexService, QueryService
│ │ └── service/ # Search SPI interfaces
│ │
│ ├── skillhub-storage/ # Object storage SPI
│ │ ├── local/ # LocalFileStorageService
│ │ └── s3/ # S3StorageService (AWS SDK v2)
│ │
│ ├── skillhub-infra/ # Infrastructure: JPA repos, utilities
│ │ └── repository/ # Spring Data JPA repository implementations
│ │
│ ├── skillhub-notification/ # Notification service (SSE, email)
│ │ ├── domain/ # Notification domain model
│ │ ├── service/ # Notification delivery services
│ │ └── sse/ # SSE endpoint support
│ │
│ ├── Dockerfile.dev # Dockerfile for staging builds
│ ├── Dockerfile # Production multi-stage build
│ ├── pom.xml # Parent POM (Spring Boot 3.2.3 parent)
│ └── scripts/
│ └── run-dev-app.sh # Local dev startup script
│
├── web/ # React frontend (Vite + pnpm)
│ ├── src/
│ │ ├── api/ # OpenAPI-generated types + fetch client
│ │ │ └── generated/
│ │ │ └── schema.d.ts # Generated OpenAPI types (CHECKED IN)
│ │ ├── app/ # Router, layout, global providers
│ │ ├── docs/ # In-app documentation pages
│ │ ├── entities/ # Domain entity display logic
│ │ │ ├── skill/ # Skill card, detail components
│ │ │ ├── user/ # User profile components
│ │ │ └── namespace/ # Namespace display components
│ │ ├── features/ # Business feature modules
│ │ │ ├── admin/ # Admin panel features
│ │ │ ├── auth/ # Login, OAuth flows
│ │ │ ├── governance/ # Skill governance actions
│ │ │ ├── namespace/ # Namespace management
│ │ │ ├── notification/ # User notifications
│ │ │ ├── promotion/ # Skill promotion workflows
│ │ │ ├── publish/ # Skill upload/publish UI
│ │ │ ├── report/ # Skill reporting
│ │ │ ├── review/ # Review workflow UI
│ │ │ ├── search/ # Skill search and filtering
│ │ │ ├── security-audit/ # Security audit viewer
│ │ │ ├── skill/ # Skill detail, listing
│ │ │ ├── social/ # Stars, ratings, subscriptions
│ │ │ └── token/ # API token management
│ │ ├── i18n/ # Internationalization
│ │ ├── pages/ # Route-level page components
│ │ ├── shared/ # Shared UI, hooks, utilities
│ │ │ ├── components/ # Reusable UI components
│ │ │ ├── hooks/ # Custom React hooks
│ │ │ ├── lib/
│ │ │ │ └── utils.ts # cn() class merging utility
│ │ │ └── ui/ # Radix UI-based primitives
│ │ └── types/ # Additional TypeScript types
│ ├── e2e/ # Playwright E2E tests
│ ├── nginx.conf.template # Nginx runtime config template
│ ├── Dockerfile # Multi-stage build (Node → Nginx)
│ └── package.json # Dependencies (React 19, TanStack Query, Radix UI, etc.)
│
├── scanner/ # Security scanner (Python/FastAPI)
│ ├── docs/ # Scanner documentation
│ ├── examples/ # Example scan inputs/outputs
│ └── Dockerfile # Scanner container build
│
├── docs/ # Design documents (source of truth)
│ ├── prds/ # Product requirement documents
│ ├── skillhub/ # VitePress user guide source
│ └── superpowers/ # Internal tooling docs
│
├── document/ # VitePress documentation site (published)
│ ├── docs/ # Markdown documentation
│ ├── src/ # VitePress theme
│ └── i18n/ # Internationalization
│
├── deploy/k8s/ # Kubernetes manifests (basic)
├── monitoring/ # Prometheus + Grafana stack
├── scripts/ # Build, test, and deployment scripts
│ ├── smoke-test.sh # Basic API smoke test
│ ├── namespace-smoke-test.sh # Namespace workflow smoke test
│ ├── governance-smoke-test.sh # Governance flow smoke test
│ ├── promotion-smoke-test.sh # Promotion flow smoke test
│ ├── check-openapi-generated.sh # Verify OpenAPI SDK is not stale
│ ├── validate-release-config.sh # Validate release env configuration
│ ├── dev-process.sh # Local process manager (PID-based)
│ ├── runtime.sh # Runtime deployment script
│ ├── parallel-init.sh # Parallel worktree initialization
│ ├── parallel-sync.sh # Merge worktrees in integration branch
│ ├── parallel-up.sh # Merge + start dev environment
│ ├── parallel-down.sh # Stop parallel dev environment
│ └── prepare-pr-batch.sh # Batch PR preparation
│
├── .github/
│ ├── workflows/ # GitHub Actions CI/CD
│ ├── ISSUE_TEMPLATE/ # Issue templates
│ └── scripts/ # Deno scripts for triage, release notes, rewards
│
├── AGENTS.md # AI agent rules (this file)
├── .agents/skills/ # Focused AI skill definitions
├── Makefile # Top-level build/test/dev orchestration
├── docker-compose.yml # Local dev dependency services
├── compose.release.yml # Production release compose file
├── CONTRIBUTING.md # Contribution guidelines
├── CODE_OF_CONDUCT.md # Community standards
└── README.md # Project overview
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 600 lines · 6,853 tokens per session scan A e0b010f1070f
skillhub AGENTS.md is an instructions file published in the GitHub repository iflytek/skillhub (4,939 stars, last pushed today), licensed Apache-2.0. It adds 6,853 tokens to every session, about $0.0343 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
ClawTeam-OpenClaw CLAUDE.md
Instructions for win4r/ClawTeam-OpenClaw, covering claude.md, what this project is, common commands, dev install (from repo root) and cli entry points.
coinos-skills CLAUDE.md
Instructions for aicoincom/coinos-skills, covering claude.md, project overview, architecture, coinclaw 三引擎适配 and 关键设计决定.
lalaclaw AGENTS.md
Instructions for aliramw/lalaclaw, covering agents.md, 开发服务启动 / dev servers, 前端开发服务 / frontend, 后端开发服务 / backend and 联调说明 / notes.
last30days-skill-cn CLAUDE.md
Claude Code instructions for Jesseovo/last30days-skill-cn, covering last30days-cn, purpose, structure, commands and release notes.
fanqie-publisher-skill AGENTS.md
Instructions for amm10090/fanqie-publisher-skill, covering fanqie-publisher-skill — codex cli agent adapter, read first, prerequisites, entry points and utf-8 / unicode safeguards.
agentsec AGENTS.md
Instructions for semiotic-ai/agentsec, covering agents.md - project rules for agents, package manager, monorepo structure, package naming and dependency graph.