ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alibaba/anolisa --skill prompt-scannergit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/prompt-scanner)<a href="https://agentmods.dev/skills/alibaba/anolisa/prompt-scanner"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/prompt-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alibaba/anolisa/prompt-scanner"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/prompt-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01694 |
| Opus 5.5 | $0.00041 | $0.00678 |
| Sonnet 5.5 | $0.00021 | $0.00339 |
| Haiku 4.5 | $0.00010 | $0.00169 |
Grade A, and why
prompt-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 140 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prompt Scanner
多层 prompt 注入 / 越狱检测引擎。L1 规则引擎做快速正则匹配，L2 ML 分类器（Llama Prompt Guard 2）做语义理解，两层协同覆盖从简单关键词注入到复杂语义越狱的各种攻击手法。
何时使用
- 用户让你检查一段 prompt 是否安全
- 用户怀疑某个输入包含注入攻击或越狱尝试
- 需要在执行用户提供的 prompt 前做安全预检
- 批量审计 prompt 日志中的可疑文本
- 用户提到"prompt 注入""jailbreak""提示词攻击"等关键词
调用方式
最常用的调用方式——直接传入待扫描文本：
agent-sec-cli scan-prompt --text '<prompt_text>'
其他输入方式：
# 从文件批量扫描（每行一条 prompt）
agent-sec-cli scan-prompt --input <file_path>
# 从 stdin 管道读取
echo '<prompt_text>' | agent-sec-cli scan-prompt
参数
| 参数 | 默认值 | 说明 |
|---|---|---|
--text |
— | 直接指定扫描文本（优先级最高） |
--input |
— | 文本文件路径，每行一条 prompt |
--mode |
standard |
检测模式，见下方选择指南 |
--format |
json |
输出格式：json 或 text（人类可读） |
--source |
"" |
输入来源标签（如 user_input、rag、tool_output），记录到审计日志 |
--text、--input、stdin 三者至少提供一种，优先级：--text > --input > stdin。
模式选择指南
根据场景选择合适的检测模式：
| 模式 | 检测层 | 延迟 | 何时选择 |
|---|---|---|---|
fast |
L1 规则引擎 | < 5 ms | 只需快速初筛，或 ML 依赖未安装时 |
standard |
L1 + L2 ML | 20–80 ms | 默认选择，精度与速度最佳平衡 |
strict |
L1 + L2（全层执行） | 50–200 ms | 高安全场景，不希望因快速失败跳过后续检测层 |
如果不确定，直接使用默认的 standard 模式即可。
理解输出
关键字段
扫描完成后，关注这几个核心字段来判断结果：
verdict：最终判定——pass（安全）、warn（可疑，建议审核）、deny（高风险，应阻断）、error（引擎异常）threat_type：威胁类型——direct_injection（直接注入）、indirect_injection（间接注入）、jailbreak（越狱）、benign（良性）confidence：置信度 0.0–1.0，越高越确定findings：命中的具体规则列表，每条包含rule_id、severity、evidence（匹配到的文本片段）
向用户沟通结果
根据 verdict 值给出不同级别的反馈：
- pass → 告知用户文本未检测到安全风险
- warn → 提示发现潜在风险，引用
findings中的evidence说明具体匹配内容，建议用户审核 - deny → 明确警告存在高置信度的注入/越狱攻击，引用具体证据，建议阻断该输入
- error → 说明扫描引擎遇到错误，建议用户检查输入或重试
完整输出 Schema
| 字段 | 类型 | 说明 |
|---|---|---|
schema_version |
string | 固定 "1.0" |
ok |
bool | 无威胁时为 true |
verdict |
string | pass / warn / deny / error |
risk_level |
string | low / medium / high / critical |
threat_type |
string | direct_injection / indirect_injection / jailbreak / benign |
confidence |
float | 置信度 0.0–1.0 |
summary |
string | 人类可读摘要 |
findings |
array | 命中的规则详情（rule_id, severity, title, evidence, category） |
layer_results |
array | 各层检测摘要（layer, detected, score, latency_ms） |
engine_version |
string | 引擎版本号 |
elapsed_ms |
float | 总耗时（毫秒） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 140 lines · 103 tokens per session scan A 0871b2b95a23
prompt-scanner is a skill published in the GitHub repository alibaba/anolisa (603 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 103 tokens to every session and 1,694 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
swarm-scripts
Bulk, repeat, fan-out, or data-heavy work: write and run swarm scripts (inline script-run, named script-upsert, durable launch-script-run). Covers the script-vs-tool rubric, the authoring contract (args first, ctx second), the seed catalog, connections and secrets, files and bash over the agent-fs drive (ctx.fs…
agent-evolution
A guide to making an AI agent improve from its past runs. It covers how to judge results, extract reusable lessons, and decide whether to store them as knowledge, instructions, code, or model training.
post-training-strategy
A guide to choosing and planning ways to improve an AI model after its initial training. It explains when to add knowledge, teach a response format, use trial-and-error training, or use a smaller model to learn from a larger one.
apps
Build and iterate on schema-backed Swarm Apps with live models, named queries, custom actions, and json-render interfaces using the app-upsert, app-get, app-list, and app-patch tools.
kapso-whatsapp
How to interact with Kapso WhatsApp from the swarm — read inbound webhook payloads (text AND media), fetch message history, send free-form messages within the 24h session window (and template messages outside it), mark-as-read, show the typing indicator, send reactions, download media, verify webhook signatures, and…
composio
Use Composio from Agent Swarm through the agent-swarm x composio CLI route, the swarmx MCP tool, or a registered ctx.api.composio script connection. Trigger when a task needs connected third-party app tools such as Gmail, Google Calendar, Google Docs, Google Drive, GitHub, Slack, Notion, or HubSpot through Tool Router…