Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alisunstar/opensunstar/modelscope-api-skillnpx skills add alisunstar/OpenSunstar --skill modelscope-api-skillgit clone --depth 1 https://github.com/alisunstar/OpenSunstarWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00088 | $0.05682 |
| Opus 5 | $0.00044 | $0.02841 |
| Sonnet 5 | $0.00018 | $0.01136 |
| Haiku 4.5 | $0.00009 | $0.00568 |
Grade C, and why
modelscope-api scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
"curl -fsSL https://modelscope.cn/skills/install.sh | bash -s -- @Alipay/alipay-payment-integration", Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://www.modelscope.cn/openapi/v1/skills?page_number=1&page_size=10&search=股票" | python -m json.tool How it starts
The opening of the file, as written. The whole thing — 576 lines — stays where its author put it; the contents beside it link to each section on GitHub.
魔塔社区（ModelScope）API 完整手册
概述
本 Skill 封装魔塔社区全部可用 API，包括：模型库、数据集、技能中心（80K+ 技能）、MCP 广场（9.4K+ 服务器）。支持Token自动引导注册。
两种响应格式注意：
/api/v1/*（旧）：PascalCase →{"Code": 200, "Data": {...}}/openapi/v1/*（新）：snake_case →{"success": true, "data": {...}}
第一步：Token 设置（首次使用必读）
⚠️ 安全警告：此技能包含只读操作和变更操作。部署、删除、安装等变更操作需要你明确确认。请使用最小必要权限的 Token。
权限建议
| 操作类型 | 所需权限 | 说明 |
|---|---|---|
| 只读操作（搜索、查询） | 读取权限 | 无需 Token，公开可用 |
| 下载操作（模型、数据集） | 下载权限 | 需要 Token |
| 变更操作（创建、部署、删除） | 写入权限 | 必须明确用户确认 |
💡 建议：优先使用只读 Token，仅在需要下载/部署时才提供写入权限。
Token 获取与使用原则
🔒 核心原则：Token 只在当前会话中使用，不写入任何文件，不保存到记忆。
Token 优先级（从上到下）：
- 环境变量
MODELSCOPE_API_TOKEN（最安全，推荐） - 直接提供（没有环境变量时，AI 会直接询问你）
没有 Token 时：直接告诉 AI「我的魔塔 Token 是 xxx」，AI 会在本次会话中使用它，执行完即丢弃。
情况 A：已有 Token
方式一（推荐）：设置环境变量
export MODELSCOPE_API_TOKEN="ms-xxxxxx"
方式二：直接告诉 AI（AI 不会记录，仅当前会话使用）
没有 Token → 引导注册：
- 打开注册页面：https://www.modelscope.cn/my/overview
- 用手机号/支付宝/钉钉完成注册登录
- 登录后，点右上角头像 → 「访问令牌」(Access Token)
- 点「新建令牌」，填写名称（如
workbuddy） - ⚠️ 重要：权限选择「只读」或「下载」，除非你需要部署功能，否则不要选「全部」
- 复制生成的 Token（格式：
ms-xxxxxx），只显示一次，务必保存
⚠️ Token 即密码，不要提交到 GitHub。
获取 Token 后，直接告诉 AI 或设置环境变量，AI 在当前会话中使用后即丢弃，不记录。
能力一：技能中心（Skills）
总技能数：80,505+
1.1 搜索/列出技能
curl -s "https://www.modelscope.cn/openapi/v1/skills?page_number=1&page_size=10&search=股票" | python -m json.tool
Query 参数：
| 参数 | 类型 | 说明 |
|---|---|---|
page_number |
int | 页码，默认 1 |
page_size |
int | 每页数量，默认 10 |
search |
string | 搜索关键词（匹配 display_name） |
无需 Token 即可访问。
响应示例：
{
"success": true,
"data": {
"total": 80505,
"skills": [
{
"id": "@Alipay/alipay-payment-integration",
"display_name": "支付宝支付集成skill",
"description": "...",
"category": "developer-tools",
"view_count": 21881,
"downloads": 2069
}
]
}
}
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 576 lines · 88 tokens per session scan C d479cfad4233
modelscope-api is a skill published in the GitHub repository alisunstar/OpenSunstar (40 stars, last pushed 18d ago), licensed Apache-2.0. It adds 88 tokens to every session and 5,682 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
supericons-icon-search
Use Supericons MCP when the user needs to find, preview, compare, retrieve, or recommend SVG icons for software UI.
avos-history
Get chronological history of a subject using avos history.
avos-search
Search repository memory with avos ask for engineering context.
avos-ingest-pr
Ingest a single PR into avos memory after pushing.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.