Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ai-dvps/comate/send-wecom-msgnpx skills add ai-dvps/comate --skill send-wecom-msggit clone --depth 1 https://github.com/ai-dvps/comateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ai-dvps/comate/send-wecom-msg)<a href="https://agentmods.dev/skills/ai-dvps/comate/send-wecom-msg"><img src="https://agentmods.dev/badge/skills/ai-dvps/comate/send-wecom-msg.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.01157 |
| Opus 5 | $0.00020 | $0.00579 |
| Sonnet 5 | $0.00008 | $0.00231 |
| Haiku 4.5 | $0.00004 | $0.00116 |
Grade A, and why
send-wecom-msg scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<quick_start> Send a message to a user:
wecom send --to-user USERID --message "Hello from the team" --session-id ${CLAUDE_SESSION_ID}
Send a markdown message:
wecom send --to-user USERID --message "**Bold** and `code`" --msg-type markdown --session-id ${CLAUDE_SESSION_ID}
If wecom is not in PATH, use npx wecom or the full path from WECOM_CLI_PATH.
</quick_start>
**Build Failed**
Error:
TypeError: Cannot read property 'id' of undefined at processData (src/utils.ts:42)
Please check the logs.
Send with:
wecom send --to-user LiSi --message "**Build Failed**\n\nError:\n\`\`\`\nTypeError: Cannot read property 'id' of undefined\n at processData (src/utils.ts:42)\n\`\`\`\n\nPlease check the logs." --msg-type markdown --session-id ${CLAUDE_SESSION_ID}
<anti_patterns> Never guess a user ID. If the recipient is unclear, ask: "Who should receive this message? Provide the WeCom user ID."
Report the actual exit code and meaning to the user. </anti_patterns>
<success_criteria>
- Recipient is specified via
--to-user - Message is properly quoted for shell execution
- Markdown is auto-detected when appropriate
- Session ID is passed via
--session-id - The actual CLI command is shown before or during execution
- Results (success or error) are reported clearly </success_criteria>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 136 lines · 40 tokens per session scan A 4aa1cccabc14
send-wecom-msg is a skill published in the GitHub repository ai-dvps/comate (106 stars, last pushed today), licensed Apache-2.0. It adds 40 tokens to every session and 1,157 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vercel-optimize
Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and…
dws
【何时用:仅当用户明确指向钉钉/DingTalk(钉钉文档、钉钉日程等)时使用;泛指做文档/表格/待办/审批默认走本地工具,不要误用钉钉】用 dws CLI 管理钉钉:AI表格/AI搜问(找人首选)/目标管理(Agoal)/组织大脑/日历/通讯录/群聊与机器人消息/待办/审批/考勤/日志(日报周报)/DING消息/钉钉文档/云盘/Markdown文件/AI听记/邮箱/在线电子表格(axls)/知识库/白板/开放平台文档/个人IM与OA事件订阅。用户要求操作上述钉钉产品时使用。.
ha-logs
Self-service diagnostics — query Hope Agent's local SQLite databases (logs / sessions / background jobs) directly via the exec tool to investigate problems, analyze usage, and locate root causes. Trigger on: user reports something broken / failing / slow / stuck / not responding ('X 不工作', 'X 报错', 'X 卡住', '为什么 X 失败'…
ha-data-stores
Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…
package-author
当用户要把手头的工具打包/标准化成 pinvou 插件包时使用——包括纯技能(SKILL.md)、纯 MCP 服务或它们的组合包。用户说"打包/做成插件包/标准化这个工具/给我一个能上传的标准包/写 plugin.json/加个图标"等，或给了散乱脚本/目录要整理成可上传 zip 时，用本技能把内容规范成 plugin-protocol 标准包（补 plugin.json、补 mcp/manifest.json、补 SKILL.md、补图标、校验命名）。.
docx
Comprehensive document creation, editing, and analysis with support for tracked changes, comments, formatting preservation, and text extraction. When Claude needs to work with professional documents (.docx files) for: (1) Creating new documents, (2) Modifying or editing content, (3) Working with tracked changes, (4)…