bytedance/agentkit-samples is a collection of examples and tutorials for Volcengine AgentKit, an AI-agent development platform for building, deploying, and operating agent applications. Developers use the samples to learn agent creation, multi-agent collaboration, memory, retrieval, MCP integrations, media generation, customer service, and other workflows. The catalogue skills provide agent workflows based on these examples.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bytedance/agentkit-samples/byted-security-clawsentrynpx skills add bytedance/agentkit-samples --skill byted-security-clawsentrygit clone --depth 1 https://github.com/bytedance/agentkit-samplesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bytedance/agentkit-samples/byted-security-clawsentry)<a href="https://agentmods.dev/skills/bytedance/agentkit-samples/byted-security-clawsentry"><img src="https://agentmods.dev/badge/skills/bytedance/agentkit-samples/byted-security-clawsentry.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.00958 |
| Opus 5 | $0.00029 | $0.00479 |
| Sonnet 5 | $0.00012 | $0.00192 |
| Haiku 4.5 | $0.00006 | $0.00096 |
Grade A, and why
byted-security-clawsentry scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ClawSentry
Agent Rules
IMPORTANT: You MUST follow these steps EXACTLY when using this skill:
-
FIRST: Verify Node.js is installed on the system (version 14 or higher).
-
SECOND: Execute the script
node {baseDir}/scripts/bundle.js. -
THIRD: Verify the script executed successfully by checking:
- Check the script exit code: 0 means success, non-0 means failure
- Look for success output: "Login URL generated successfully:" in the script output
- Look for the line that starts with
[LOGIN_URL]:in the script output - Check if
{baseDir}/.state/login_state.jsonfile exists and contains a validloginUrlfield - If the file doesn't exist, wait a few seconds and try again
- If you can't find the files, try looking in
.openclaw/skills/ClawSentry/scripts/directory
-
FOURTH: After confirming the script succeeded, get the login URL using ONE of these methods (in this priority order):
- Extract from the script output by looking for the line that starts with
[LOGIN_URL]: - Read from
{baseDir}/.state/login_state.jsonfile (look for theloginUrlfield)
- Extract from the script output by looking for the line that starts with
-
FIFTH: Send the login URL to the user along with this message: "After completing login, please send me a message saying you have successfully logged in (e.g., '我已经注册成功了', '我已经登录成功了', '我已经注册好了', '登录好了', '登录上了')."
-
SIXTH: After sending the login URL to the user, you MUST perform the following monitoring for 10 minutes (600 seconds): a. EVERY MINUTE, check if the process
bundle.js --login-tokenis running using the command:ps aux | grep "bundle.js --login-token"b. If the process IS running: continue monitoring until the 10 minutes expire c. If the process IS NOT running: i. Read{baseDir}/.state/login_state.jsonfile and check theenablefield ii. Ifenableistrue: END the conversation immediately iii. Ifenableisfalse: - ReadloginTokenanddeviceFingerprintfrom{baseDir}/.state/login_state.json- Restart the process with:node {baseDir}/scripts/bundle.js --login-token [loginToken] --device-fingerprint [deviceFingerprint]d. Stop monitoring after 10 minutes have elapsed
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 64 lines · 58 tokens per session scan A 2e1fd3e188f1
byted-security-clawsentry is a skill published in the GitHub repository bytedance/agentkit-samples (446 stars, last pushed yesterday), licensed Apache-2.0. It adds 58 tokens to every session and 958 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
aatmf-t10-confidentiality-breach
AATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.
ensembl-database
Query Ensembl genome database REST API for 250+ species. Gene lookups, sequence retrieval, variant analysis, comparative genomics, orthologs, VEP predictions, for genomic research.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.
sidewinder-rattlesnake
Adversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.
sn-image-imitate
Generates a new image that imitates the style of a reference image while updating content based on user intent. Uses a three-stage pipeline: image annotation (long caption), caption rewriting, and image generation. Use when user asks to "imitate style", "保持这个风格重画", "按这张图风格生成", or "style transfer with new content".
akg-agents
代理执行 AKG 算子任务。先检查固定仓库与分支；若 /.akg/checkenv.md 不存在则强制 FULLSETUP=true；忽略所有 akgcli 检查和使用；后端代码生成直接执行 runworkflow.py --workflow kernelgen。.