Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add apexcheng/yingdao-xbot-ai-agent --skill xbot-toolsgit clone --depth 1 https://github.com/apexcheng/yingdao-xbot-ai-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apexcheng/yingdao-xbot-ai-agent/xbot-tools)<a href="https://agentmods.dev/skills/apexcheng/yingdao-xbot-ai-agent/xbot-tools"><img src="https://agentmods.dev/badge/skills/apexcheng/yingdao-xbot-ai-agent/xbot-tools/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/apexcheng/yingdao-xbot-ai-agent/xbot-tools"><img src="https://agentmods.dev/badge/skills/apexcheng/yingdao-xbot-ai-agent/xbot-tools.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01751 |
| Opus 5.5 | $0.00022 | $0.00700 |
| Sonnet 5.5 | $0.00011 | $0.00350 |
| Haiku 4.5 | $0.00005 | $0.00175 |
Grade A, and why
xbot-tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
影刀工具：CLI、应用生命周期与项目诊断
该 Skill 汇总影刀工具与项目级操作。根据任务进入「CLI 操作」「应用开发闭环」或「项目诊断」，不要求执行无关流程。默认先只读；启动任务、同步发布、改写项目文件和修复签名都要遵守各部分原有的执行边界。
新建或补全影刀编码版项目时，按需先阅读 最小 base 项目骨架与验收说明。模板文件仍位于当前项目的 project-template/，不使用参考文档替代真实项目文件。普通 CLI 账户 / 任务查询无需加载骨架说明。
CLI 操作
ShadowBot CLI 只用于影刀自身运行和生命周期操作；普通源码、配置与业务分析直接在项目工作区完成。
Executable
Prefer the stable launcher path:
C:\Program Files\ShadowBot\shadowbot.shell-cli.exe
Do not pin commands to versioned directories such as shadowbot-6.x.x; ShadowBot updates can change those folders.
按需检查与命令帮助
- CLI 连接或服务可用性不明时查
system health；涉及模式或任务状态时查system state；需要当前账号身份时查auth current。已掌握所需信息时不重复预检。 - 不熟悉命令或参数时，对目标子命令运行
-h查看当前支持的用法；不要猜 ID、参数或执行顺序。
Find ShadowBot apps/projects
已有可信项目路径或 App ID 时直接使用。需要发现时用 console app 搜索（自主开发应用为 --app-type developed，订阅应用为 subscribed）；以返回的 appId 为准，多条匹配时核对元数据，再根据当前子命令帮助查看详情或定位项目目录。
Run and inspect tasks
只有用户明确要求运行时才启动应用或任务。 运行不是只读检查；不能为了查看配置、字段、凭证等就实际执行。运行前按需核实应用和输入参数，再使用 console task run；默认同步执行并输出日志，仅在业务明确需要时使用 --async。任务查询与停止按需使用 console task status/history/logs/stop，参数以当前帮助为准。
Studio operations
ShadowBot 6.3.22 已验证：studio create 新建应用后同步关闭，且不返回 App ID；studio open 不带 --app-id 时新建应用并保持 Studio 打开。要打开已有应用，在当前 PowerShell 进程设置 SWITCH_STUDIO_MCP_CLI_SUPPORT=1，通过 studio open -h 确认支持 --app-id 后执行 studio open --app-id <uuid>。不同版本先以当前 CLI 帮助为准，不要把不带 ID 的 studio open 误用为打开已有项目。
2026-10-14 本机发布流程确认：核对已打开的 Studio 应用时，使用 studio app get 并读取 data.app.app_id。studio current get 可能只返回 Studio 状态，不含应用 ID；不要据此误判无法识别应用。若当前打开的是其它应用，停止并提示处理，不自动同步或关闭其它应用。不同版本以当前 CLI 帮助和实际返回结构为准。
Runtime modes
The CLI supports console and assistant mode switching:
"C:\Program Files\ShadowBot\shadowbot.shell-cli.exe" mode switch --to console
"C:\Program Files\ShadowBot\shadowbot.shell-cli.exe" mode switch --to assistant
Console-only operations can return not_supported in Assistant mode. Check system state before switching. Do not use --force to switch to Console while a task is running unless the user explicitly wants that interruption/risk.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines 312c25c004b3
- 2d ago Changed b29481f3e81c
- 3d ago Changed · -38 lines 5c31857f6904
- 9d ago First seen · 112 lines · 54 tokens per session scan A 8eede1068394
xbot-tools is a skill published in the GitHub repository apexcheng/yingdao-xbot-ai-agent (37 stars, last pushed today), licensed MIT. It adds 54 tokens to every session and 1,751 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-09.
Other skills, from other repositories
browse
Use the browse CLI for Browserbase browser automation, Browserbase cloud APIs, Browserbase Functions, templates, web fetch/search, diagnostics, and Browse.sh skill discovery/installation. Use when the user asks to navigate pages, inspect browser state, run local or remote browser sessions, manage Browserbase…
moli-webfetch
Fetch, inspect, crawl, and capture live, JavaScript-rendered websites with Moli. Use when Codex needs current web content, web research, fact lookup, link following, a bounded crawl, client-rendered or response-gated content, network diagnostics, or a standalone HTML, Markdown, JSON, semantic-tree, viewport or…
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
pinchtab-stealth-score
Run the PinchTab stealth-score sweep against 15 bot-detection / fingerprint sites (sannysoft, rebrowser, deviceandbrowserinfo, iphey, whoer, browserscan, pixelscan, fingerprint-scan, incolumitas, fvision, amiunique, browserleaks, creepjs, coveryourtracks, fingerprint-demo). Starts a Docker PinchTab container per…
wttr-weather
Weather via wttr.in GET (no key). Use for weather/forecast; prefer os.http.request.
actionbook-scraper
Generate and verify web scraper scripts using Actionbook's verified selectors. Auto-validates generated scripts and fixes errors.