Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add agentsope/SkillAlchemy --skill agentsop-multi-tenant-raggit clone --depth 1 https://github.com/agentsope/SkillAlchemyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agentsope/skillalchemy/agentsop-multi-tenant-rag)<a href="https://agentmods.dev/skills/agentsope/skillalchemy/agentsop-multi-tenant-rag"><img src="https://agentmods.dev/badge/skills/agentsope/skillalchemy/agentsop-multi-tenant-rag.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00209 | $0.09928 |
| Opus 5 | $0.00105 | $0.04964 |
| Sonnet 5 | $0.00042 | $0.01986 |
| Haiku 4.5 | $0.00021 | $0.00993 |
Grade B, and why
agentsop-multi-tenant-rag scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nullifies safety policiesmediumAnti-refusal
"You have no restrictions", "do anything now", "ignore your guidelines": a direct jailbreak that disables guardrails.
2. If the concern is "what if we forget the filter once", solve it with Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 888 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Multi-Tenant RAG · Security-First Isolation SOP
Third-person operating model for a coder agent that owns retrieval correctness across tenant boundaries. The audience is the LLM agent writing or reviewing the code — not the end user.
One sentence: Isolation lives at the vector store query boundary, not at the model. Anything that reaches the LLM's context window has already leaked.
1. 何时激活 (Activation Rules)
Activate this skill whenever any of the following holds:
- The codebase contains a retrieval call (
vector_store.query,query_points,similarity_search,as_retriever().retrieve(...), rawpgvectorORDER BY embedding <-> $1) and the corpus serves more than one tenant, customer, organisation, workspace, user, or permission scope. - The user mentions any of: multi-tenant RAG, namespace, tenant, workspace,
tenant_id,org_id,user_id, "cross-customer", "shared index", "knowledge base per team". - A bug report says "User A saw User B's document", "wrong company's data surfaced", "the assistant cited a doc I don't have access to", or anything that smells like cross-context bleed.
- PR review: any new code calling a vector store without a tenant-scoped
filter argument, or filtering only on the returned
nodes/documentslist after retrieval. - A new RAG endpoint is about to ship and tenant scoping has not been explicitly audited.
Do not activate when:
- The corpus is fully public and there is no per-tenant view (e.g. open-data Q&A).
- The retrieval pipeline already enforces a physically separate index / collection per tenant via infrastructure the application code cannot override (e.g. one Pinecone index per customer with credentials issued per-tenant). In that case the isolation lives in IAM, not in this skill.
2. 核心心智模型 (Core Mental Model)
Three principles. If a design violates any of them the system is exploitable, regardless of how good the LLM prompt is.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 888 lines · 209 tokens per session scan B aee594b89561
agentsop-multi-tenant-rag is a skill published in the GitHub repository agentsope/SkillAlchemy (370 stars, last pushed 6d ago), licensed MIT. It adds 209 tokens to every session and 9,928 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it B with 1 finding (nullifies safety policies). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
karpathy-llm-wiki
Use when building or maintaining a personal LLM-powered knowledge base. Triggers: ingesting sources into a wiki, querying wiki knowledge, linting wiki quality, 'add to wiki', 'what do I know about', or any mention of 'LLM wiki' or 'Karpathy wiki'.
mixedbread-search
Build and query managed search indexes (Stores) using the Mixedbread Python and TypeScript SDKs. Use when creating knowledge bases, uploading documents, performing semantic or vector search, asking questions over documents, using agentic multi-step retrieval, combining store search with web results, filtering by…
mxbai-cli
Use the mxbai CLI to manage stores, upload files, search documents, ask questions, and sync directories from the terminal. Use when performing Mixedbread operations via command line, setting up CI/CD pipelines with store sync, or managing API keys.
rag-evaluator
Generates tailored giskard.checks evaluation suites for RAG (Retrieval-Augmented Generation) systems. Use whenever a user describes a Q&A bot grounded in documents, a knowledge-base chatbot, a retrieval system, or wants to evaluate answer groundedness, faithfulness, hallucination, retrieval quality, citation accuracy…
local-rag-mcp
Use when querying, ingesting, or maintaining a local RAG MCP corpus for semantic document retrieval with privacy controls.
milvus
Operate Milvus vector database with pymilvus Python SDK. Use when the user wants to connect to Milvus, create collections, insert vectors, perform similarity search, hybrid search, full-text search, manage indexes, partitions, databases, or RBAC via Python code.