ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alibaba/anolisa/prompt-scannernpx skills add alibaba/anolisa --skill prompt-scannergit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/prompt-scanner)<a href="https://agentmods.dev/skills/alibaba/anolisa/prompt-scanner"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/prompt-scanner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01694 |
| Opus 5 | $0.00051 | $0.00847 |
| Sonnet 5 | $0.00021 | $0.00339 |
| Haiku 4.5 | $0.00010 | $0.00169 |
Grade A, and why
prompt-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prompt Scanner
多层 prompt 注入 / 越狱检测引擎。L1 规则引擎做快速正则匹配，L2 ML 分类器（Llama Prompt Guard 2）做语义理解，两层协同覆盖从简单关键词注入到复杂语义越狱的各种攻击手法。
何时使用
- 用户让你检查一段 prompt 是否安全
- 用户怀疑某个输入包含注入攻击或越狱尝试
- 需要在执行用户提供的 prompt 前做安全预检
- 批量审计 prompt 日志中的可疑文本
- 用户提到"prompt 注入""jailbreak""提示词攻击"等关键词
调用方式
最常用的调用方式——直接传入待扫描文本：
agent-sec-cli scan-prompt --text '<prompt_text>'
其他输入方式：
# 从文件批量扫描（每行一条 prompt）
agent-sec-cli scan-prompt --input <file_path>
# 从 stdin 管道读取
echo '<prompt_text>' | agent-sec-cli scan-prompt
参数
| 参数 | 默认值 | 说明 |
|---|---|---|
--text |
— | 直接指定扫描文本（优先级最高） |
--input |
— | 文本文件路径，每行一条 prompt |
--mode |
standard |
检测模式，见下方选择指南 |
--format |
json |
输出格式：json 或 text（人类可读） |
--source |
"" |
输入来源标签（如 user_input、rag、tool_output），记录到审计日志 |
--text、--input、stdin 三者至少提供一种，优先级：--text > --input > stdin。
模式选择指南
根据场景选择合适的检测模式：
| 模式 | 检测层 | 延迟 | 何时选择 |
|---|---|---|---|
fast |
L1 规则引擎 | < 5 ms | 只需快速初筛，或 ML 依赖未安装时 |
standard |
L1 + L2 ML | 20–80 ms | 默认选择，精度与速度最佳平衡 |
strict |
L1 + L2（全层执行） | 50–200 ms | 高安全场景，不希望因快速失败跳过后续检测层 |
如果不确定，直接使用默认的 standard 模式即可。
理解输出
关键字段
扫描完成后，关注这几个核心字段来判断结果：
verdict：最终判定——pass（安全）、warn（可疑，建议审核）、deny（高风险，应阻断）、error（引擎异常）threat_type：威胁类型——direct_injection（直接注入）、indirect_injection（间接注入）、jailbreak（越狱）、benign（良性）confidence：置信度 0.0–1.0，越高越确定findings：命中的具体规则列表，每条包含rule_id、severity、evidence（匹配到的文本片段）
向用户沟通结果
根据 verdict 值给出不同级别的反馈：
- pass → 告知用户文本未检测到安全风险
- warn → 提示发现潜在风险，引用
findings中的evidence说明具体匹配内容，建议用户审核 - deny → 明确警告存在高置信度的注入/越狱攻击，引用具体证据，建议阻断该输入
- error → 说明扫描引擎遇到错误，建议用户检查输入或重试
完整输出 Schema
| 字段 | 类型 | 说明 |
|---|---|---|
schema_version |
string | 固定 "1.0" |
ok |
bool | 无威胁时为 true |
verdict |
string | pass / warn / deny / error |
risk_level |
string | low / medium / high / critical |
threat_type |
string | direct_injection / indirect_injection / jailbreak / benign |
confidence |
float | 置信度 0.0–1.0 |
summary |
string | 人类可读摘要 |
findings |
array | 命中的规则详情（rule_id, severity, title, evidence, category） |
layer_results |
array | 各层检测摘要（layer, detected, score, latency_ms） |
engine_version |
string | 引擎版本号 |
elapsed_ms |
float | 总耗时（毫秒） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 140 lines · 103 tokens per session scan A 0871b2b95a23
prompt-scanner is a skill published in the GitHub repository alibaba/anolisa (617 stars, last pushed today), licensed Apache-2.0. It adds 103 tokens to every session and 1,694 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
video-frame-extractor
影片与视频编辑、自媒体创作者在需要拆解优秀视频、提取分镜参考或反推提示词时，使用本技能可自动抽取视频关键帧，调用视觉大模型批量分析画面，一键生成结构化描述与创作提示词，轻松搞定视频内容提取与场景分析。.
llm-competition-pipeline
Use when: (1) Entering an LLM-based Kaggle competition (open-source model required, prompt engineering, few-shot), (2) Need to choose between base models (Qwen, DeepSeek, LLaMA), (3) Designing a prompt strategy (zero-shot, few-shot, chain-of-thought), (4) Deciding whether fine-tuning is worth the GPU cost vs prompt…
avoid-duplicate-system-messages
How to consolidate fragmented system instructions into a single static cacheable header, maximizing Anthropic and OpenAI prompt cache hit rates and cutting input token costs by 90%.
context-optimization
Optimize effective context capacity through compression, masking, caching, and partitioning strategies. Use when the user asks to reduce token costs, improve context efficiency, implement KV-cache optimization, or extend context-window effectiveness.
manus-prompt-engineering
Design and audit Manus prompts for engineering, release, production, and security work. Use when writing a Manus prompt or reviewing a Manus execution or recording against authorization and evidence.
image-prompt-builder-nl
Craft high-quality natural-language image prompts for any modern text-to-image or image-edit model that accepts flowing English. Trigger when the user wants help writing, rewriting, improving, or translating an English natural-language image prompt — including "write me an image prompt", "improve this image prompt"…