Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bmob/agent-skills --skill bmob-cloud-function-developmentgit clone --depth 1 https://github.com/bmob/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bmob/agent-skills/bmob-cloud-function-development)<a href="https://agentmods.dev/skills/bmob/agent-skills/bmob-cloud-function-development"><img src="https://agentmods.dev/badge/skills/bmob/agent-skills/bmob-cloud-function-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bmob/agent-skills/bmob-cloud-function-development"><img src="https://agentmods.dev/badge/skills/bmob/agent-skills/bmob-cloud-function-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00095 | $0.02933 |
| Opus 5.5 | $0.00038 | $0.01173 |
| Sonnet 5.5 | $0.00019 | $0.00587 |
| Haiku 4.5 | $0.00010 | $0.00293 |
Grade A, and why
bmob-cloud-function-development scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. **未配置 MCP**:按 [云函数文档](https://github.com/bmob/BmobDocs/blob/master/mds/cloud_function/web/develop_doc.md) 与 REST `/1/functions/<name>` / 控制台流程给代码与 curl How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bmob 云函数开发
用于写运行在 Bmob 服务器上的云函数源码,并在已配置 MCP 时走 deploy_cloud_function → invoke_cloud_function 完成上传与验证,或走 list_cloud_functions → get_cloud_function 将线上函数同步到本地。
先判断走哪条通道
- 已配置 Bmob MCP:优先用
bmob-mcp- 上传源码:
deploy_cloud_function - 单独验证:
invoke_cloud_function - 同步线上 → 本地:
list_cloud_functions→get_cloud_function(agent 写本地文件)
- 上传源码:
- 未配置 MCP:按 云函数文档 与 REST
/1/functions/<name>/ 控制台流程给代码与 curl
语法基线
默认按 Bmob 云函数文档的 Web/Node 风格写:
function onRequest(request, response, modules) {
response.send("hello");
}
- GET 直连参数:
request.query.xxx - POST / REST 参数:
request.body.xxx - 返回结果:
response.send(...) - 数据库 / 文件 / HTTP / 加密:从
modules取oData、oFile、oHttp、oCrypto等
必须遵守的已知行为
- 通过 REST API 调用时,参数从
request.body取,不是request.query - 云函数里很多回调返回的是字符串,需要
JSON.parse(data)后再当对象用 - 已知行为:服务端可能把传入
request.body的值转成字符串;涉及数字、布尔、数组、对象时,在云函数内显式parseInt/=== "true"/JSON.parse modules.oData的where是 JSON 对象,不要JSON.stringify:- ✅ 云函数内:
db.find({ "table": "Level", "where": { "status": 1 } }) - ❌ 错误:
"where": JSON.stringify(where)— 会把条件变成字符串,查询失效或行为异常 - 仅 REST GET 的 query 参数
where才需要 URL 编码的 JSON 字符串(见bmob-database-restful);不要把 REST 写法套进oData
- ✅ 云函数内:
默认工作流
1. 写源码
- 函数名与用户要调用的名字一致
- 优先写最小可验证版本,再逐步扩展
- 如果要查表 / 改表,先确认表名与字段名;用户已配 MCP 时先读
get_project_tables
2. 上传源码
已配 MCP 时,优先调用:
deploy_cloud_functionfuncName: 云函数名code: 源码原文language:1=javascript,2=javaverify: 需要立即验证时传1verify_data: 验证入参 JSON 字符串,默认{}
3. 验证结果
- 如果上传工具已设置
verify=1,直接检查返回里的verify.response - 如果需要多次验证,单独调用
invoke_cloud_function - 验证失败时,优先把上传结果、执行返回、传入参数三者一起对照
4. 部署成功后:告知用户如何调用
deploy_cloud_function 成功时,响应里会带 invokeGuide。向用户说明调用方式时:
- 禁止只写裸 URL(如
POST https://api.codenow.cn/1/functions/xxx)——REST 必须带完整 headers 与 body - 优先直接使用
invokeGuide.rest.curl(已含X-Bmob-Application-Id、X-Bmob-REST-API-Key、Content-Type与示例 body) - 按当前项目类型只展示一种最匹配的 SDK 示例(从
invokeGuide.sdk选取):- 读代码库判断:
package.json/ Vue / React →javascript;app.json/ 小程序 →wechat_miniprogram;build.gradle/ Android SDK →android;Podfile/ ObjC →ios;BmobCloud.run/ SwiftPM →swift;pubspec.yaml/bmob_plugin→flutter;无 SDK 或用户要 curl →restful - 不确定时:REST curl + 说明「你的项目若是 XX 平台可参考 invokeGuide.sdk.XX」
- 读代码库判断:
- 需要更详细的 curl 样板:可再调
generate_code→type=调用云函数 - 展示完调用示例后,主动询问用户是否需要试跑(已配 MCP 时):
- 话术示例:「云函数已部署。上面是 REST / SDK 调用方式。需要我帮你用 MCP 模拟参数试跑一下吗?」
- 用户同意 → 根据云函数源码里
request.body的字段,推断或向用户确认测试参数 - 调用
invoke_cloud_function:funcName= 函数名,data= 测试入参的 JSON 字符串(如{"limit":10,"skip":0,"status":1}) - 把执行结果(成功 / 报错 / 返回体)反馈给用户;失败时对照「上传结果 + 执行返回 + 传入参数」排查
- 用户未配 MCP 或未同意试跑:只给调用说明,不自动执行
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 260 lines · 95 tokens per session scan A 5f2b3024fb3b
bmob-cloud-function-development is a skill published in the GitHub repository bmob/agent-skills (4 stars, last pushed 5d ago), licensed MIT. It adds 95 tokens to every session and 2,933 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sf-integration
Configure Salesforce integrations: Named Credentials, Connected Apps, External Services, Platform Events, CDC, and auth flows. Use when setting up integration infrastructure, metadata XML, or choosing architecture patterns. Activate on .namedCredential-meta.xml, .connectedApp-meta.xml, .platformEvent-meta.xml…
sf-omnistudio
Comprehensive OmniStudio / Salesforce Industries development skill covering OmniScripts, FlexCards, Integration Procedures, Data Mappers (DataRaptors), namespace detection, dependency mapping, and migration patterns. TRIGGER when: user works with OmniStudio components, asks about OmniScripts, FlexCards, Integration…
sf-flow
Generate Flow metadata XML and migrate Process Builders to Flows. Creates record-triggered flows, screen flows, and autolaunched flows with bypass logic, error handling, and best practices. Use when asked about Flows, Process Builder migration, .flow-meta.xml files, or Salesforce automation. Activate on mentions of…
sf-schema
Scaffold custom objects, fields, validation rules, permission sets, and other schema metadata as SFDX source XML. Use when asked to create objects, custom fields, permission sets, validation rules, or generate metadata XML. Activate on mentions of "custom object", "custom field", "permission set", "validation rule"…
sf-soql
Build and optimize SOQL queries including relationship queries, aggregate functions, polymorphic TYPEOF, and selective filters. Use when asked to write queries, debug slow queries, optimize existing SOQL, or enforce query security. Activate on mentions of "SOQL", "query", "SELECT", "WHERE", "aggregate", "relationship…
sf-apex
Generate and review Apex code for Salesforce with governor limit awareness, bulkification patterns, and CRUD/FLS compliance. Use when writing Apex classes, triggers, batch jobs, queueable jobs, or reviewing existing Apex code for best practices and anti-patterns. Activate on .cls files, mentions of "Apex", "trigger"…