Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/17lang/mindraw4agent/mindraw-open-canvasnpx skills add 17lang/mindraw4agent --skill mindraw-open-canvasgit clone --depth 1 https://github.com/17lang/mindraw4agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/17lang/mindraw4agent/mindraw-open-canvas)<a href="https://agentmods.dev/skills/17lang/mindraw4agent/mindraw-open-canvas"><img src="https://agentmods.dev/badge/skills/17lang/mindraw4agent/mindraw-open-canvas.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.01327 |
| Opus 5 | $0.00019 | $0.00664 |
| Sonnet 5 | $0.00008 | $0.00265 |
| Haiku 4.5 | $0.00004 | $0.00133 |
Grade A, and why
mindraw-open-canvas scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mindraw Project Canvas
Open the project-scoped Mindraw canvas from the active Codex workspace.
Trigger
Use this skill when the user says:
Open the Mindraw canvas for this project.Open Mindraw in sidebar for this project.Open Mindraw app for this project.在侧边栏打开这个项目的 Mindraw在 Mindraw App 中打开这个项目- Open the current project Mindraw canvas.
- Show the project canvas in Mindraw.
- Create a project Mindraw canvas.
Procedure
-
Treat the active Codex workspace directory as
projectRoot; do not use the plugin directory as the project root. -
Prefer the
mindraw_mcpserver toolinspect_mindraw_project_canvasto inspect or createprojectRoot/MindrawCanvas/through Mindraw's approved App API. On macOS, if no canvas exists and the runtime capability file is unavailable, the plugin may cold-launch Mindraw, wait forcreateBlankPackage, and retry the App API. -
Route the request by explicit open location:
- Sidebar preview:
Open Mindraw in sidebar for this project.and在侧边栏打开这个项目的 Mindraw. - Mindraw desktop app:
Open Mindraw app for this project.and在 Mindraw App 中打开这个项目. - Compatibility/default sidebar preview:
Open the Mindraw canvas for this project..
- Sidebar preview:
-
For sidebar preview and compatibility/default requests, always start the local read-only sidebar preview service and expose its URL. Desktop handoff alone is not a valid result for these triggers.
-
Run
scripts/start-canvas.shfrom this plugin with the project root and keep the service running:./scripts/start-canvas.sh "/absolute/project/root" -
Open the printed project-scoped
http://127.0.0.1:<port>/?project=<hash>URL in the Codex browser/sidebar when available, and include the URL,projectRoot,MindrawCanvas/directory, status, and any blocker in the response. If browser opening is unavailable, still return the clickable URL and state. If the preferred local port belongs to another Mindraw project service, use the newly printed URL instead of reusing the old port. -
For Mindraw desktop app requests, call
open_mindraw_project_canvasafter inspect/create, and hand off through MindrawopenPackagecapability when available. On macOS, if the runtime capability file or App API is unavailable, the handoff may fall back to LaunchServices for the exact latest-created.mindrawpackage. App requests do not need to start or return the sidebar preview URL. -
Call
open_mindraw_project_canvasfor sidebar requests only when the sidebar's编辑button / preview double-click path is invoked, or when the user explicitly asks to edit/open in the Mindraw desktop app. -
For sidebar preview, expect the page to poll
/api/state, reload/api/previewwith a project identity token plus revision cache-buster, and expose a manual refresh control. If Mindraw cannot prove a fresh preview source or the sidebar belongs to another project service, the sidebar must show a visible blocker instead of a stale image. -
If
编辑or preview double-click opens Mindraw but focus/frontmost status is not confirmed, tell the user that the package was handed off and they may need to switch to Mindraw or another macOS Space. Treat this as actionable feedback, not a silent no-op. -
Report blockers exactly. Do not convert them into a generic failure:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 68 lines · 38 tokens per session scan A 5b241dbda881
mindraw-open-canvas is a skill published in the GitHub repository 17lang/mindraw4agent (0 stars, last pushed 1mo ago), licensed MIT. It adds 38 tokens to every session and 1,327 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other skills, from other repositories
agentbro-release
Use when releasing AgentBro from this repository: merging dev/main, bumping versions, updating release notes, tagging, pushing, monitoring GitHub Actions, Homebrew cask publication, or fixing a bad release.
agentbro-pr-merge
Use when reviewing, fixing CI for, approving workflows for, or merging AgentBro pull requests into dev/main, especially external contributor PRs where contributor attribution matters.
hydra
Use when a task should run through Hydra's Lead-driven workflow for multi-agent orchestration, or when an existing workflow must be inspected or cleaned up.
source-command-check
跑全套本地校验(前端 lint/test/build + Rust check)。.
challenge
Adversarial review skill. Use when the user wants to stress-test an idea, argument, proposal, or opinion from multiple independent angles. Spawns parallel Hydra workers with orthogonal analytical methodologies.
code-review
Structured code review skill. Use when asked to "review this code", "review this PR", "check this diff", or when acting as a Hydra reviewer. Runs a multi-pass review with specialist focus areas and confidence-gated findings.