Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/apache/doris-skills/resource-isolationnpx skills add apache/doris-skills --skill resource-isolationgit clone --depth 1 https://github.com/apache/doris-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.00887 |
| Opus 5 | $0.00022 | $0.00443 |
| Sonnet 5 | $0.00009 | $0.00177 |
| Haiku 4.5 | $0.00004 | $0.00089 |
Grade A, and why
doris-debug-resource-isolation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Resource Isolation (Workload Group)
Causes
| ID | Cause | Evidence | Source anchor |
|---|---|---|---|
| A | Queue starvation | Queries queued in SHOW WORKLOAD GROUPS; QueueTime growing |
WorkloadGroupMgr.java |
| B | CPU oversubscription | One WG consuming >90% CPU despite limits | CgroupCpuCtl.cpp |
| C | Memory leak across groups | MemTracker shows one WG exceeding memory_limit |
WorkloadGroupMemMgr.cpp |
| D | Tag routing wrong | Query hits wrong BE set; ResourceTag mismatch | ResourceTag.java, Tag.java |
| E | WG not active / cgroup missing | CREATE WORKLOAD GROUP had no effect |
WorkloadGroupMgr.cpp cgroup init |
10 min triage
-- Workload group status
SHOW WORKLOAD GROUPS\G
-- Check columns: Id, Name, ActiveQueries, QueuedQueries, CpuShares, MemoryLimit
-- Which WG is my query in?
SELECT * FROM information_schema.workload_group_resource_usage;
-- Workload policies (routing rules)
SHOW WORKLOAD POLICY\G
# BE cgroup inspection
cat /sys/fs/cgroup/cpu/doris/<wg_id>/cpu.shares
cat /sys/fs/cgroup/memory/doris/<wg_id>/memory.limit_in_bytes
./scripts/doris-debug be-metrics --be http://$BE:8040 --grep "workload_group"
Cause A — Queue starvation
-- See who's queued
SHOW WORKLOAD GROUPS\G
-- Raise queue concurrency
ALTER WORKLOAD GROUP etl_wg SET (
"max_concurrency" = "8",
"max_queue_size" = "100",
"queue_timeout" = "300"
);
Check be/src/pipeline/task_scheduler.cpp — the pipeline scheduler respects cgroup shares; if a high-share WG starves a low-share one, the low-share WG's queue backs up.
Cause B — CPU oversubscription
-- Create a hard CPU cap
ALTER WORKLOAD GROUP report_wg SET (
"cpu_share" = "1024",
"cpu_hard_limit" = "200%" -- 2 cores max
);
-- Force query into specific WG
SET workload_group = 'report_wg';
cgroup v1 vs v2 behavior differs. Confirm which is active on BE hosts:
mount | grep cgroup
ls /sys/fs/cgroup/cpu/doris/ # cgroup v1
ls /sys/fs/cgroup/doris/ # cgroup v2
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 112 lines · 43 tokens per session scan A 524439745037
doris-debug-resource-isolation is a skill published in the GitHub repository apache/doris-skills (37 stars, last pushed 13d ago), licensed Apache-2.0. It adds 43 tokens to every session and 887 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mongodb-natural-language-querying
Generate read-only MongoDB queries (find) or aggregation pipelines using natural language, with collection schema context and sample documents. Use this skill whenever the user asks to write, create, or generate MongoDB queries, wants to filter/query/aggregate data in MongoDB, asks "how do I query...", needs help with…
yida-data-management
宜搭数据管理。表单实例/子表/流程实例/任务中心的查询、新增、更新。表单走 /v1/form/，流程走 /v1/process/，不能混用。.
yida-business-rule
宜搭表单业务关联规则与高级函数配置。用于在表单设置中配置业务关联规则，或使用 INSERT、UPDATE、DELETE、UPSERT 高级函数实现跨表增删改。适用于需要表单间数据联动的场景。.
yida-aggregate-table
宜搭聚合表（virtualView）管理。用于列出、创建空聚合表、读取/预览设计配置、保存草稿、发布配置和查询构建状态；严格区分 stash 与 live revision，并在写入前校验固定前端已确认的六数组契约。.
yida-db-seq-fix
PostgreSQL Sequence 自动修复工具。检测并修复宜搭环境检测自动建表时 Sequence 起始值问题，避免主键冲突。当用户提到"Sequence"、"主键冲突"、"自增ID错误"、"db-seq-fix"时触发。.
mongodb-connection
Optimize MongoDB client connection configuration (pools, timeouts, patterns) for any supported driver language. Use this skill when working/updating/reviewing on functions that instantiate or configure a MongoDB client (eg, when calling connect()), configuring connection pools, troubleshooting connection errors…