Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/artisancloud/powerx/httpnpx skills add ArtisanCloud/PowerX --skill httpgit clone --depth 1 https://github.com/ArtisanCloud/PowerXWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/artisancloud/powerx/http)<a href="https://agentmods.dev/skills/artisancloud/powerx/http"><img src="https://agentmods.dev/badge/skills/artisancloud/powerx/http.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.03560 |
| Opus 5 | $0.00013 | $0.01780 |
| Sonnet 5 | $0.00005 | $0.00712 |
| Haiku 4.5 | $0.00003 | $0.00356 |
Grade A, and why
crud-http scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 447 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PowerX CRUD HTTP
步骤
- 打开
本文件内嵌规则。 - 按规则执行实现/校对。
- 完成后按核对清单验收。
核对点
- 与 PowerX 当前代码结构、路径与命名一致。
- 仅在传输层/契约层做职责内改动,不跨层越界。
规则(内嵌)
dev_crud_http_guides.md
# PowerX 开发规范入口(Dev Guides)
> 本文档是 PowerX 的统一开发规范入口。
>
> - 人类可阅读:开发与评审统一看这里。
> - 工具可扩展:未来可被 `/plan` 与 `/tasks` 解析成可验证规则。
---
## 1. 目的与范围(Scope)
本规范适用于所有 PowerX 核心与插件模块中涉及 **CRUD 能力** 的后端开发,
包括但不限于以下层次:
- 迁移(Migration)
- GORM 模型(Model)
- Repository(仓库层,含 BaseRepository)
- Service(业务服务层)
- DTO(入参/出参)
- Handler(HTTP 层)
- 依赖注入(DI)
- 路由(Routes)
- 契约 / 集成测试(Tests)
---
## 2. 全局策略(Policies)
- **数据库**:统一使用 **GORM 抽象**,默认 **Postgres**。
不允许写死 MySQL 方言或独立 SQL 文件;索引与唯一约束以 GORM tag 或迁移注册为准。
- **HTTP 路由**:统一前缀 `/api/v1/admin/**`(可配置)。
- **多租户**:所有查询与写入都必须携带 `tenant_id`。
- **审计**:所有写操作(Create/Update/Delete/Presign)必须记录审计日志。
- **安全**:预签名链接仅允许受管路径、受限方法(GET/PUT)与 MIME 白名单。
- **依赖注入**:所有仓库与服务实例必须由 `internal/app/shared/deps.go` 统一注册。
---
## 3. 层次结构(Layer Overview)
```plaintext
Model → Repository → Service → Handler → Router
↘ DI(shared) ↙
```
---
## 4. Migration(迁移)
### 约定
- **统一入口**:`cmd/database/migrate.go`
由该入口统筹调用各模块的迁移函数。
- **两种迁移模式**
1. **独立 Server 模块(如 Agent)**:在 `cmd/database/migrate.go` 内实现 `MigrateAgentModels(db *gorm.DB) error`,仅使用 `db.AutoMigrate(...)` 注册模型。
2. **CoreX 内核模块(如 MediaX)**:在 `pkg/corex/db/migration.go` 内实现 `MigrateCoreModels(db *gorm.DB) error`,由其中**直接调用 `AutoMigrate`** 将核心模型(含 MediaX)纳入迁移。
- **不交付任何 `.sql` 文件**,迁移中禁止手写 `db.Exec(...)`。
- **索引/唯一约束**:一律在 **GORM 模型结构体标签**中声明(含唯一索引、GIN 索引、部分索引等)。
- **运行期校验(可选)**:如需校验可用 `db.Migrator().HasIndex()` / `HasConstraint()`,但**不得因此写原生 SQL**。
- **错误处理**:所有迁移函数必须返回 `error`,并在统一入口串联调用。
---
### 示例
#### A. 独立 Server 模块(Agent)
> 在 `cmd/database/migrate.go` 内直接定义并调用:
```go
// cmd/database/migrate.go
package main
import (
"log"
"gorm.io/gorm"
dbmodel "github.com/your/module/internal/server/agent/persistence/model"
)
func MigrateAgentModels(db *gorm.DB) error {
if err := db.AutoMigrate(
&dbmodel.Agent{},
&dbmodel.AgentSetting{},
); err != nil {
return err
}
// 可选:运行期校验(不写 SQL)
if ok := db.Migrator().HasIndex(&dbmodel.Agent{}, "agent_uniq_tenant"); !ok {
log.Println("warn: agent_uniq_tenant not created")
}
return nil
}
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 447 lines · 25 tokens per session scan A b13099e422cc
crud-http is a skill published in the GitHub repository ArtisanCloud/PowerX (364 stars, last pushed 3d ago), licensed Apache-2.0. It adds 25 tokens to every session and 3,560 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
scalar-docs
Skill for writing and updating scalar.config.json — Scalar Docs configuration reference for users and LLMs.
openapi-glossary
Use consistent OpenAPI terminology and definitions when writing documentation, educational material, and tooling guidance.
wxjava-api-contributor
按 WxJava 的 Maven 多模块、Java 8、公共 API 兼容性和 TestNG 约定,为微信官方接口新增或维护 SDK 支持。适用于新增 Service API、请求响应 Bean、序列化、HTTP 实现、Starter 配置或回归测试时。.
datamodel-code-generator
Use this skill when the user wants Python data models, Pydantic models, dataclasses, TypedDicts, msgspec structs, or type-safe Python classes generated from OpenAPI, AsyncAPI, JSON Schema, GraphQL, JSON/YAML/CSV sample data, MCP tool schemas, Protocol Buffers, XML Schema, Apache Avro, or existing Python model objects.…
langbot-deploy
Deploy and configure a LangBot instance — Docker / Docker Compose, Kubernetes, the config.yaml model, the Box sandbox runtime, the plugin runtime, and the global API key. Use when installing, deploying, upgrading, or configuring LangBot in production or self-hosted environments. Triggers on "deploy langbot", "langbot…
om-auto-sec-report-pr
Paranoid OWASP-oriented security analysis for a SINGLE unit of work — one PR, one spec under .ai/specs/, or one branch diff. Hunts non-obvious attack vectors beyond OWASP Top 10, flags same-pattern hotspots elsewhere, and emits "Next steps — go deeper" follow-ups. Writes markdown + HTML under .ai/analysis/; runs…