ANOLISA is a server-side operating layer for AI agent workloads that provides terminal access, token-saving tool-output compression, runtime controls, security, observability, skills, memory, and sandbox management. It is for running and supervising agents from a Linux terminal while retaining an existing shell, agent framework, and sandbox. The catalogue add-ons are components of its agent operating environment and workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alibaba/anolisa --skill regex-masterygit clone --depth 1 https://github.com/alibaba/anolisaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/anolisa/regex-mastery)<a href="https://agentmods.dev/skills/alibaba/anolisa/regex-mastery"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/regex-mastery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alibaba/anolisa/regex-mastery"><img src="https://agentmods.dev/badge/skills/alibaba/anolisa/regex-mastery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 324 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Prompt Injection · line 57 Subtle instructions detected that may alter agent decision-making or introduce hidden biases.Fix: Review content for implicit steering or bias. Ensure instructions are explicit and align with the skill's stated purpose.
- medium Prompt Injection · line 289 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.03690 |
| Opus 5.5 | $0.00024 | $0.01476 |
| Sonnet 5.5 | $0.00012 | $0.00738 |
| Haiku 4.5 | $0.00006 | $0.00369 |
Grade A, and why
regex-mastery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 325 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When this skill is activated, always start your first response with the 🧢 emoji.
Regex Mastery
Regular expressions are a compact language for describing text patterns, built into virtually every programming language and text processing tool. They power input validation, log parsing, data extraction, search-and-replace, and tokenization. Used well, a single regex can replace dozens of lines of string manipulation code. Used poorly, they become unreadable traps and can grind a server to a halt via catastrophic backtracking.
When to use this skill
Trigger this skill when the user:
- Asks to write or explain a regular expression
- Wants to validate input format (email, URL, phone number, date, credit card)
- Needs to extract data from structured or semi-structured text (logs, CSV, HTML)
- Uses regex terminology: lookahead, lookbehind, named group, capture group, backreference
- Wants to debug a pattern that isn't matching as expected
- Asks about regex flags (
i,g,m,s,u,x) - Needs to replace text using capture groups or back-references
Do NOT trigger this skill for:
- Full HTML/XML parsing (use a proper parser like DOMParser or BeautifulSoup instead)
- Complex natural language processing where ML models are a better fit
Key principles
- Readability over cleverness - A regex that nobody can maintain is worse than
a slightly longer explicit approach. Break complex patterns into commented steps
or use the verbose (
x) flag where supported. A named group costs nothing but pays dividends every time someone reads the pattern. - Use named capture groups -
(?<year>\d{4})is self-documenting and immune to positional breakage when the pattern changes. Always prefer named groups over numbered groups for any regex that will be read or maintained by humans. - Test edge cases relentlessly - Empty string, Unicode characters, very long
input, malformed-but-close input (e.g.,
foo@barfor email), and adversarial input designed to trigger backtracking. A regex that passes your happy path but fails on a Unicode em-dash will cause production incidents. - Avoid catastrophic backtracking - Nested quantifiers (
(a+)+) and overlapping alternatives ((a|ab)+) cause exponential backtracking on non-matching input. Use atomic groups or possessive quantifiers where available, or restructure alternation so choices are mutually exclusive. - Use the right tool - Regex is not always the answer. Parsing emails to RFC 5321 compliance requires a full parser. Parsing JSON, HTML, or XML requires a DOM/SAX parser. If a regex exceeds ~80 characters or requires >2 levels of nesting, pause and ask whether a small state machine or parser would be clearer.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 325 lines · 60 tokens per session scan A 7b1a697142bb
regex-mastery is a skill published in the GitHub repository alibaba/anolisa (603 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 60 tokens to every session and 3,690 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
apps
Build and iterate on schema-backed Swarm Apps with live models, named queries, custom actions, and json-render interfaces using the app-upsert, app-get, app-list, and app-patch tools.
kapso-whatsapp
How to interact with Kapso WhatsApp from the swarm — read inbound webhook payloads (text AND media), fetch message history, send free-form messages within the 24h session window (and template messages outside it), mark-as-read, show the typing indicator, send reactions, download media, verify webhook signatures, and…
swarm-scripts
Bulk, repeat, fan-out, or data-heavy work: write and run swarm scripts (inline script-run, named script-upsert, durable launch-script-run). Covers the script-vs-tool rubric, the authoring contract (args first, ctx second), the seed catalog, connections and secrets, files and bash over the agent-fs drive (ctx.fs…
composio
Use Composio from Agent Swarm through the agent-swarm x composio CLI route, the swarmx MCP tool, or a registered ctx.api.composio script connection. Trigger when a task needs connected third-party app tools such as Gmail, Google Calendar, Google Docs, Google Drive, GitHub, Slack, Notion, or HubSpot through Tool Router…
motion-design-video-analysis
Reverse-engineer a short motion-design / product-update video (animation technique, timing and easing, composition, transitions, likely tooling, vibe, audio) and produce a rebuild spec someone can build from. Default path is one call to google/gemini-3.8-flash over sampled frames, then a mandatory by-eye check of…
open-prompt-showreel
Make a design-led motion-graphics video (showreel, eval comparison, feature or bug-hunt story) from one open prompt. Claude Opus at max effort designs, codes and renders the whole thing itself in a scratch dir, with no template and no repo PR. Use for any "make a video for X" / "do a showreel for Y" / "a little…