Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cass-2003/local-workflow-skill/sdk-integrationnpx skills add cass-2003/local-workflow-skill --skill sdk-integrationgit clone --depth 1 https://github.com/cass-2003/local-workflow-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cass-2003/local-workflow-skill/sdk-integration)<a href="https://agentmods.dev/skills/cass-2003/local-workflow-skill/sdk-integration"><img src="https://agentmods.dev/badge/skills/cass-2003/local-workflow-skill/sdk-integration.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03859 |
| Opus 5 | $0.00033 | $0.01929 |
| Sonnet 5 | $0.00013 | $0.00772 |
| Haiku 4.5 | $0.00007 | $0.00386 |
Grade A, and why
sdk-integration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SDK Integration
首次自称：SDK Integration（sdk-integration）。
定位：把第三方 SDK 从“示例能跑”收敛为“版本、初始化、鉴权、环境、回调、错误、隐私、升级和验收可控”。本技能处理合法公开 SDK 的工程集成，不做闭源 SDK 逆向、供应链审计或支付核心后端替代。
适用范围
- 普通第三方 SDK 接入：Web、Node、iOS、Android、Flutter、React Native、Unity、后端服务或多端 SDK。
- 初始化、配置、鉴权、app key/client id、环境切换、region、feature flag、回调、事件、错误码和日志。
- SDK 升级迁移、breaking changes、版本锁定、依赖冲突、示例改造、灰度发布和回滚。
- 多端一致性：同一业务在 Web/App/服务端 SDK 中的字段、状态、错误和回调契约对齐。
- SDK 官方示例验收、最小闭环 demo、mock/sandbox/live 环境分离和上线 checklist。
不适用范围
- 闭源 SDK 逆向、二进制供应链审计、ABI 恢复、符号分析、反编译或安全取证；转 sdkrev。
- 支付 SDK 的后端扣款、退款、回调验签、对账、状态机核心；转对应支付技能。
- 地图 SDK 的 provider 专项接入；转高德、Google Maps、Mapbox、腾讯地图等地图技能。
- 只读学习、项目上手、仅识别依赖中出现 SDK，没有集成、升级、调试、测试或发布动作。
- 未授权破解 SDK、绕过 license、盗用 key、规避风控、隐藏采集或供应链投毒。
铁律
- 未确认 SDK 名称、版本、平台、官方文档、授权范围、环境、鉴权方式和业务闭环前，不开始改代码。
- SDK key/secret/token 只按官方边界放置；server secret 不进前端、移动包、日志、截图和错误体。
- 初始化必须幂等、可观测、可降级；重复 init、热更新、SSR、App 前后台切换和多实例都要有策略。
- 回调契约必须稳定：事件名、payload、顺序、重试、线程/队列、错误码和生命周期要绑定业务状态机。
- SDK 升级默认高风险；必须读 release notes、breaking changes、迁移指南、弃用项和最小版本要求。
- 环境必须分离：dev/sandbox/staging/live 的 endpoint、key、tenant、region、webhook 和数据隔离不能混用。
- 示例代码只能作为入口；必须改成项目错误处理、权限、隐私、日志、超时、重试和回滚风格。
- 没有官方示例、真实最小闭环、失败场景和回滚验证，不报告 SDK 集成完成。
强制流程
- 输入锁定：确认 SDK、平台、版本、业务目标、官方文档、账号/租户、环境、权限、数据流和禁止项。
- 版本策略：锁定版本范围、包管理器、transitive dependencies、minimum OS/runtime、兼容矩阵和回滚版本。
- 初始化设计：定义 init 时机、单例/多实例、配置来源、鉴权、重试、超时、日志、降级和重复调用行为。
- 权限隐私：列 SDK 需要的系统权限、用户授权、数据采集、隐私披露、开关、脱敏和合规文案交接。
- 回调契约：梳理 success/fail/cancel/progress/webhook/event listener、线程/队列、重复投递、乱序和业务状态迁移。
- 错误模型：把 SDK error code 映射成项目稳定错误；保留 request id、trace id、SDK version 和脱敏上下文。
- 多端对齐：同一业务字段、状态、错误和事件在 Web/App/服务端 SDK 中保持兼容。
- 验证闭环：跑官方示例、项目最小闭环、负向、弱网、权限拒绝、环境切换、升级回滚和发布前 smoke。
- 交付：输出版本、配置、初始化点、回调矩阵、错误映射、验证证据、风险和回滚方案。
场景执行卡
回调与密钥矩阵
- 回调契约必须列 event name、payload schema、签名/验签边界、幂等键、重放窗口、ack 语义、重试、乱序、线程/队列和业务状态迁移。
- 鉴权材料分级：publishable/client key、server secret、refresh token、license、webhook secret 分别写允许端、日志、包体、截图、错误体和 CI 规则。
- 验证证据至少包含官方示例、项目最小闭环、sandbox/live 切换、负向、弱网、权限拒绝、回滚版本和 smoke 结果。
- 多端差异要记录 Web SSR/CSR、Node、iOS、Android、Flutter/RN、Unity 的生命周期、线程、权限、包体、混淆/R8、SPM/CocoaPods/Gradle/npm 锁定。
- 参考公开 SDK 时看 release notes、migration guide、examples、CI、privacy/security policy 和 issue 中的 breaking change。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 172 lines · 66 tokens per session scan A f4848c508855
sdk-integration is a skill published in the GitHub repository cass-2003/local-workflow-skill (12 stars, last pushed 1mo ago), licensed MIT. It adds 66 tokens to every session and 3,859 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…