Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bmob/agent-skills/bmob-database-javascriptnpx skills add bmob/agent-skills --skill bmob-database-javascriptgit clone --depth 1 https://github.com/bmob/agent-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00296 | $0.03703 |
| Opus 5 | $0.00148 | $0.01852 |
| Sonnet 5 | $0.00059 | $0.00741 |
| Haiku 4.5 | $0.00030 | $0.00370 |
Grade A, and why
bmob-database-javascript scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: "Use when implementing Bmob NoSQL database CRUD with the cross-platform hydrogen-js-sdk (3.0+ supports both Secret Key + API 安全码 and Application ID + REST API Key init) — ONE SDK file (Bmob-x.x.x.min.js) cov How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bmob Database — JavaScript / 跨端 SDK
hydrogen-js-sdk 是 同一个 SDK 文件 Bmob-<version>.min.js 支持以下所有宿主环境，无平台分支代码：
- 浏览器 / 任何 Web 前端（React、Vue 2、Vue 3、Next.js、Nuxt、Vite、Astro、SvelteKit、Solid 等）
- Node.js 服务端（必须源码引入）
- 微信小程序 / 支付宝 / 字节跳动 / QQ / 百度 小程序
- 快应用
- Cocos Creator JS
- Electron / Tauri
- 任意混合 App（WebView 内嵌 H5）
本 skill 只覆盖新版 hydrogen-js-sdk（
Bmob.Query('X')Promise 风格，3.0+）。基于 Backbone.js 的旧bmob-min.js（Bmob.Object.extend("X")callback 风格）不要用，也不要回退。
核心原则
1. 初始化支持两种方式（hydrogen-js-sdk 3.0+ 均兼容；按场景二选一，不要混用）：
方式 A — Secret Key + API 安全码（推荐：浏览器 / 小程序 / 公开客户端，SDK 内部走加密授权）：
Bmob.initialize("你的Secret Key", "你的API 安全码");
- Secret Key：控制台 → 应用 → 设置 → 应用密钥 → Secret Key。
- API 安全码：控制台 → 应用 → 应用功能设置 → 安全验证 → API 安全码 自行设置。
方式 B — Application ID + REST API Key（3.0 起正式兼容；适合已有 1.x/2.x 项目迁移、或与服务端 REST 共用同一套 Key）：
Bmob.initialize("你的Application ID", "你的REST API Key");
- Application ID / REST API Key：控制台 → 应用 → 设置 → 应用密钥 同一页。
- REST API 请求域名一般为
https://api.codenow.cn（见bmob-database-restful）。
2.x 时代方式 B 功能受限；3.0+ 两种初始化等价可用。公开 bundle 仍优先方式 A（REST API Key 可被抓包）。
2. 不要 commit 真实密钥进 git；CDN / dist 不要写死 SDK 版本号。 密钥用环境变量（Vite import.meta.env.VITE_BMOB_*、Next.js process.env.NEXT_PUBLIC_BMOB_*、小程序构建期注入等）。dist 文件名为 Bmob-<version>.min.js，有打包工具时用 npm install hydrogen-js-sdk；纯 CDN 浏览器场景用 jsDelivr API 动态取 tags.latest 再拼 URL（见 references/platform-init.md）。禁止在示例里写 @2.7.3 这类会过期的具体版本。
3. 默认查询返回 100 条，最大 1000。需要更多用 skip + limit 分页或走 BQL（bmob-bql skill）。
4. 三个保留字段不能手动写入：objectId、createdAt、updatedAt。读 objectId 时用 res.objectId（不是 id）。
5. 时间字段比较的精度：createdAt / updatedAt 在服务器是微秒精度，应用层做时间比较时要 +1 秒。
安全清单
- 密钥分级：浏览器 / 小程序 / 移动端优先 Secret Key + API 安全码（方式 A），永不用 Master Key。若用 Application ID + REST API Key（方式 B），REST API Key 会暴露在 bundle 中。
- 生产环境关闭调试模式：
Bmob.debug(true)仅在小程序开发时使用，上线前删掉。 - 小程序必须配置服务器域名白名单：微信后台
request合法域名至少添加https://api.bmobcloud.com（见references/platform-init.md微信小程序段）。 - 微信小程序若使用 npm 引入 SDK，需先在开发者工具执行“工具 --> 构建 npm”：未构建时
import Bmob from "hydrogen-js-sdk"不会生效。 - 写入的表必须配 ACL：否则任意用户可改任意行。参见
bmob-acl-and-roles（P1）。 - 批量操作上限 50 条（含批量更新、批量删除）。超出需循环。
- 批量查询上限 100 条 / 单次 1000 条：避免一次拉全表。
-
Bmob.User.login在小程序里要先调用wx.login()获取 code，否则会话拿不到 sessionToken。
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/batch.md 2.5 KB
- references/platform-init.md 10 KB
- references/pointer-and-relation.md 4.1 KB
- references/query.md 3.8 KB
- references/realtime.md 3.5 KB
- references/snippets/api-reference--acl的格式-01.txt 90 B
- references/snippets/api-reference--collection-01.txt 612 B
- references/snippets/api-reference--collection-排序-01.txt 120 B
- references/snippets/api-reference--then-方法-01.txt 118 B
- references/snippets/api-reference--一对一关系和一对多关系-01.txt 484 B
- references/snippets/api-reference--一对一关系和一对多关系-02.txt 94 B
- references/snippets/api-reference--一对一关系和一对多关系-03.txt 91 B
- references/snippets/api-reference--一对一关系和一对多关系-04.txt 124 B
- references/snippets/api-reference--修改一个-collection-01.txt 450 B
- references/snippets/api-reference--修改数据-01.txt 536 B
- references/snippets/api-reference--修改数据-02.txt 337 B
- references/snippets/api-reference--修改数据-03.txt 171 B
- references/snippets/api-reference--关联-01.txt 526 B
- references/snippets/api-reference--其他对象的安全-01.txt 196 B
- references/snippets/api-reference--其他对象的安全-02.txt 371 B
- references/snippets/api-reference--其他对象的安全-03.txt 159 B
- references/snippets/api-reference--其他对象的安全性-01.txt 211 B
- references/snippets/api-reference--其他对象的安全性-02.txt 164 B
- references/snippets/api-reference--分页查询-01.txt 43 B
- references/snippets/api-reference--分页查询-02.txt 44 B
- references/snippets/api-reference--创建-promise-01.txt 146 B
- references/snippets/api-reference--创建-promise-02.txt 107 B
- references/snippets/api-reference--创建地理位置对象-01.txt 66 B
- references/snippets/api-reference--创建对象-01.txt 141 B
- references/snippets/api-reference--创建对象-02.txt 430 B
- references/snippets/api-reference--创建异步方法-01.txt 211 B
- references/snippets/api-reference--创建角色-01.txt 120 B
- references/snippets/api-reference--删除关联关系-01.txt 35 B
- references/snippets/api-reference--删除关联关系-02.txt 60 B
- references/snippets/api-reference--删除字段-01.txt 72 B
- references/snippets/api-reference--删除数据-01.txt 141 B
- references/snippets/api-reference--删除数组-01.txt 315 B
- references/snippets/api-reference--原子计数器-01.txt 47 B
- references/snippets/api-reference--取消订阅行删除的事件-01.txt 54 B
- references/snippets/api-reference--取消订阅行更新的事件-01.txt 54 B
- references/snippets/api-reference--取消订阅表更新的事件-01.txt 43 B
- references/snippets/api-reference--复杂查询-01.txt 121 B
- references/snippets/api-reference--复杂查询-02.txt 127 B
- references/snippets/api-reference--复杂查询-03.txt 353 B
- references/snippets/api-reference--复杂查询-04.txt 358 B
- references/snippets/api-reference--多对多关系-01.txt 103 B
- references/snippets/api-reference--多对多关系-02.txt 49 B
- references/snippets/api-reference--安装实时数据平台的js-01.txt 62 B
- references/snippets/api-reference--安装实时数据平台的js-02.txt 48 B
- references/snippets/api-reference--对字符串类型做查询-01.txt 128 B
- references/snippets/api-reference--将promise-组织在一起-01.txt 395 B
- references/snippets/api-reference--常见数据类型的操作-01.txt 410 B
- references/snippets/api-reference--并行的promise-01.txt 510 B
- references/snippets/api-reference--当前用户-01.txt 135 B
- references/snippets/api-reference--当前用户-02.txt 85 B
- references/snippets/api-reference--或查询-01.txt 361 B
- references/snippets/api-reference--数据对象-01.txt 49 B
- references/snippets/api-reference--数组查询-01.txt 85 B
- references/snippets/api-reference--数组查询-02.txt 127 B
- references/snippets/api-reference--整个文件上传-01.txt 176 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 284 lines · 296 tokens per session scan A 4d64938f3964
bmob-database-javascript is a skill published in the GitHub repository bmob/agent-skills (3 stars, last pushed 1mo ago), licensed MIT. It adds 296 tokens to every session and 3,703 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
one-on-one-prep
Deep-dive preparation for 1:1 meetings with direct reports. Surfaces recent work, wins, friction, wellbeing signals, and development goal progress, anchored in the org's performance framework, organizational values, and management best practices. Produces a prep sheet with suggested conversation topics, not a script.
performance-cycle
Evidence gathering for performance review cycles. Gathers goal completion evidence, peer feedback, development progress, scope changes, and values alignment, organised along the org's performance framework dimensions, with organizational values as the 'how' lens. Surfaces evidence gaps. Never suggests ratings, only…
team-health
Periodic check on team dynamics, engagement signals, and development trajectory for all direct reports. Surfaces patterns across the team: who might need more challenge, who might need more support, who hasn't had a 1:1 recently. Uses two universal lenses: performance & growth, and wellbeing & connection. Outputs are…
handoff
Write a session handoff at the end of a session so the next session can start from where this one stopped without rereading the whole conversation. Use when user says "handoff", "wrap up", "write a handoff", "end of session", "park this session", "save where we are", or to RESUME with "/handoff read", "pick up the…
setup-content-studio
Set up a new content studio for a person. Copies the plugin template, adapts it to the person's voice, themes, and content types through interactive discovery. Use when asked to create a content studio for someone new.
kb-answer
Answer questions using your project's knowledge base with evidence-backed citations. Every answer must cite literal quotes from KB files to prevent hallucinations. Use this for any question that should be answered from documented knowledge rather than general knowledge.