Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/comisai/comis/deep-researchnpx skills add comisai/comis --skill deep-researchgit clone --depth 1 https://github.com/comisai/comisWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00117 | $0.01795 |
| Opus 5 | $0.00059 | $0.00898 |
| Sonnet 5 | $0.00023 | $0.00359 |
| Haiku 4.5 | $0.00012 | $0.00179 |
Grade A, and why
deep-research scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deep Research
Systematic methodology for thorough web research. Load this skill BEFORE starting any content generation task to gather sufficient information from multiple angles, depths, and sources.
Core Principle
Never generate content based solely on general knowledge. The quality of output depends directly on research quality. A single search query is never enough.
For context-dependent follow-ups about attribution, failed sources, or compression, re-fetch every candidate citation from the existing research before using it in the new answer and preserve the user's requested format. If the user says a source is down but no failed receipt identifies one, do not invent an unavailable URL; report only failures observed during re-fetch.
Before answering, obtain at least three distinct successful web_search query receipts covering different research angles and at least three distinct successful web_fetch receipts from three different URLs. If fewer than three successful query receipts or source receipts can be obtained, label the result partial or incomplete, name each unavailable source or capability blocker, and do not fill the evidence gap from memory.
Build a receipt ledger keyed by canonical URL before writing. Re-fetching the same URL does not count as another source, even when the options or returned length differ. Continue fetching until the ledger has three unique successful URLs; otherwise abstain from a substantive answer and return only the incomplete-research status.
Every factual paragraph or claim cluster in the answer must carry an inline citation to one or more fetched URLs that support it. Omit any statement the fetched sources do not support. On every failed source fetch, name the failed URL in an Unavailable sources note with its error; never cite or use that source as evidence.
Every URL presented as a citation must have a successful web_fetch receipt from the current research run. A web_search result or snippet is discovery evidence, not citation evidence. Fetch a discovered source before citing it; if the fetch fails, omit it from citations and name it separately as an attempted but unavailable source.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 159 lines · 117 tokens per session scan A f688eccbedb5
deep-research is a skill published in the GitHub repository comisai/comis (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 117 tokens to every session and 1,795 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
org-sync
Use when the CEO wants an organization-wide sync across PuPu's agent teams — running each org's internal sync, then a cross-org sync where departments challenge each other, converging into one decision list. Triggers: "跑一次 org sync", "全局同步", "组织盘点", "/org-sync", "各部门现在什么情况", "有什么要我拍板的".
release-feature-audit
Use when a new PuPu feature finishes implementation and needs its consistency audit before its ticket is marked done — "audit #123", "审计这个功能", "这个 feature 过一遍检查" — or when release-close-sprint roll-call finds a new feature that was never audited. Also covers standalone i18n checks ("漏翻了吗", "检查 i18n"), which used to be…
gitnexus-impact-analysis
Use when the user wants to know what will break if they change something, or needs safety analysis before editing code. Examples: "Is it safe to change X?", "What depends on this?", "What will break?".
growth-analyst
Use when analyzing PuPu's open-source growth or health for the founder — GitHub traffic, downloads/installs, releases, community, or contributor activity — or when producing a growth report or weekly COO report. Repo is haoxiang-xu/PuPu. Triggers: "how is PuPu growing?", "are people installing PuPu?", "which release…
test-api
Use when running QA / regression tests against PuPu, when verifying a code change actually works in the running app, or when reading PuPu UI/state without screenshotting manually. Triggers on tasks like "test that PuPu still creates chats correctly", "verify the new model selector works end-to-end", "send a message…
org-court
Use when any org-change proposal needs adjudication - adding/removing/redesigning agents or teams, changing org rules, or evaluating org granularity. Runs PuPu's HR court: a proposal is heard by four dimension assessors (comm efficiency / context cleanliness / signal ratio / routing cost), the judge verifies evidence…