Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/appautomaton/pi-arcweld/verifynpx skills add appautomaton/pi-arcweld --skill verifygit clone --depth 1 https://github.com/appautomaton/pi-arcweldWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00001 | $0.00331 |
| Opus 5 | $0.00000 | $0.00166 |
| Sonnet 5 | $0.00000 | $0.00066 |
| Haiku 4.5 | $0.00000 | $0.00033 |
Grade B, and why
verify scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
4. Verify persistence by inspecting raw `mcp.json`: only `enabled` changes, `${TOKEN}` remains literal, and the current panel session state stays independent. What it actually says
Verify MCP extension
- Create a throwaway
PI_CODING_AGENT_DIRwithmcp.jsoncontaining the stdio fixture (test/fixture-server.ts), a disabled server, and a broken server. - Launch in an isolated tmux socket from this package directory so
--import tsxresolves:tmux -L mcpverify new-session -d -s pi 'PI_CODING_AGENT_DIR=<dir> pi -e .' - Type
/mcp; capture withtmux -L mcpverify capture-pane -pt pi. Exercise Enter/Space,r,d,y/n, Esc, and resize withtmux resize-window. - Verify persistence by inspecting raw
mcp.json: onlyenabledchanges,${TOKEN}remains literal, and the current panel session state stays independent. - Restart Pi against the same directory and confirm the persisted default controls startup.
- For cache evidence, configure
models.jsonwith a localhostopenai-completionsprovider whose server records request JSON and returns a minimal SSE completion. Send one prompt, run/mcp disable <server>, then send another. Compare captured requests:messages[0].contentandtoolsmust be byte-identical; the MCP runtime update must appear only as a later message.
Use only throwaway config and localhost endpoints. Never exercise the user's real remote MCP servers or credentials during verification.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 17 lines · 1 tokens per session scan B 097420e3b1b5
verify is a skill published in the GitHub repository appautomaton/pi-arcweld (6 stars, last pushed 2d ago), licensed MIT. It adds 1 tokens to every session and 331 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cvm-ai-doctor
CVM 实例健康诊断,采用智能快速/深度检查模式。涵盖性能和使用问题专业检查、诊断、和修复。支持服务器、PC、虚拟机、容器场景，支持 Linux/macOS/Windows。.
octop_assistant
帮助用户配置和管理 Octop 自身。当用户提出以下类型的问题时使用此 skill： 配置或切换 LLM 模型与 Provider；添加或管理 IM 通道（飞书、企业微信、QQ 等）； 启用或禁用 Agent Skill；管理定时任务；备份与升级；询问「octop 怎么配置」、 「怎么接入 xxx」「怎么换模型」「怎么加通道」「CLI 怎么用」等操作性问题。 即使用户只是问「怎么配置 octop」，也应触发此 skill。.
source-verify
医学信源快速或完整核验。普通教育性医学问答用单一权威正文快速核验；最新版本、精确推荐、高风险药品、医保监管或跨版本请求升级为完整核验。只整理学习依据，不生成诊疗、处方、急诊处置、医保报销结论或HIS执行建议。.
wechat-publisher-personal
Personal Multi-Platform Publisher — 一文多发工具，将 Markdown 文章同时发布到内容运营平台和社交内容平台。微信端通过 wenyan-cli + 自建服务器代理，社交内容平台端通过浏览器自动化。.
publish
Publish the Octop Python package: cut a release branch from develop, bump version, update CHANGELOG, open a PR to main; after merge, Actions tag on main (PyPI / Docker Hub) and sync main into develop. Use when the user asks to publish, release, bump version, cut a release, or run /publish.
daily-hot-news
Skill "daily-hot-news" from TencentCloud/Octop, covering 每日热点新闻播报, 工作流程概览, 第一步：意图分类与主题路由, 1.1 识别查询意图 and 1.2 匹配主题与数据源.