wizard

wizard is a skill for Claude Code, Codex from devcxl/mattpocock-skills-zh. It costs 71 tokens per session (1,130 once invoked), scanned A, original, MIT.

A skill for creating temporary Bash scripts that guide a person through manual setup, credential, infrastructure, or migration steps. Bash is a command-line scripting language; the guide can open links, ask for values, and save them in approved places.

In plain words
What is it for?
It is for configuring third-party services, entering environment values, setting CI secrets, and carrying out one-time migrations or switches through a step-by-step terminal wizard.
Why use it?
It reduces repeated explanations for steps that require a person's account access or decisions, while keeping secrets out of the agent's control.

Skill for Claude CodeCodex

Written for Claude Code and Codex: shipped in a Claude Code plugin, but also agents/openai.yaml present.

Part of the mattpocock-skills plugin — 37 skills shipped together

Good fit It is for configuring third-party services, entering environment values, setting CI secrets, and carrying out one-time migrations or switches through a step-by-step terminal wizard.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/devcxl/mattpocock-skills-zh/wizard
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add devcxl/mattpocock-skills-zh --skill wizard
Clone the repo
git clone --depth 1 https://github.com/devcxl/mattpocock-skills-zh

Made for: Claude Code, Codex.

Or install mattpocock-skills, the plugin that ships this one along with the rest of its 37 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for wizard

README.md
[![agentmods](https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/wizard/github.svg)](https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/wizard)
Your own site
<a href="https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/wizard"><img src="https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/wizard/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for wizard

Your own site · 80×15
<a href="https://agentmods.dev/skills/devcxl/mattpocock-skills-zh/wizard"><img src="https://agentmods.dev/badge/skills/devcxl/mattpocock-skills-zh/wizard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 71 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,130 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00071 $0.01130
Opus 5 $0.00036 $0.00565
Sonnet 5 $0.00014 $0.00226
Haiku 4.5 $0.00007 $0.00113

Measured 9d ago against content hash 2855874fd345, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

wizard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (template.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/engineering/wizard/SKILL.md · 45 lines

What it actually says

向导

向导(Wizard) 是一个 bash 脚本,逐步引导人类完成手动流程——这些流程手动做很繁琐,每次重新向 AI 解释也很麻烦。它会打开每个 URL,精确说明要点击什么和复制什么,捕获值,将其写入正确的位置(.env、GitHub secrets),在每个阶段确认,并显示剩余阶段数。它可能配置第三方服务、运行一次性迁移、或把项目从一个状态迁移到另一个状态。

便捷的 UX 已经由 template.sh 解决——分阶段显示进度、确认关卡、跨平台 URL 打开(含 WSL)、隐藏密文输入、幂等的 .env 写入、gh secret/gh variable 写入,以及一个结束汇总。你的工作只是界定流程范围并编写其阶段。 每个向导中 STAGES 标记上方的库代码都是相同的——这种一致性正是关键所在,永远不要手动编辑它。

向导默认是临时的——为一次运行而创建,保存在 scratch 或 scripts/ 路径下,任务完成后删除。仅当用户希望创建一个可重复的设置路径(应留在仓库中)时才提交它。

流程

1. 界定流程范围

找出人类必须执行的每一个手动步骤以及沿途捕获的每一个值。先阅读仓库——不要凭空提问:

  • 对于设置:.env.env.example.env.*READMEdocker-compose*、框架配置,以及 .github/workflows/*(每个 secrets.* / vars.* 引用都是向导必须产生的值)。
  • 对于迁移或切换:当前状态、目标状态,以及两者之间的不可逆操作。

然后向用户展示有序的阶段列表以及每个阶段产生的值,并确认——他们可能会添加、删除或重新排序。

完成条件: 每个阶段都按顺序命名,并且对于每个捕获的值,你知道 (a) 人类从哪里获取它,(b) 它写入哪里(.env、GitHub secret、两者皆写,或都不写——有些阶段只是纯操作),以及 (c) 它是秘密(隐藏输入)还是公开的。

2. 绘制每个阶段的路径

为每个阶段编写人类遵循的精确路径:打开哪个 URL,在那里做什么,值在哪里显示,填充哪个变量——例如"Dashboard → Developers → API keys → Reveal test key → copy"。如果你不确定当前 UI 或确切命令,请说明并询问用户或查阅文档——永远不要编造可能不存在的步骤。

完成条件: 每个阶段都能追溯到具体的指令,让一个陌生人也能照着做。

3. 编写向导

template.sh 复制到目标路径。将示例阶段替换为每个步骤一个 stage,按依赖顺序排列。使用库辅助函数——stagesay/stepopen_urlask/ask_secretwrite_envset_secret/set_varpause/confirm——并设置 TOTAL_STAGES 为你编写的阶段数。

保持模板设定的标准:在要求值之前先打开 URL,对任何秘密内容使用 ask_secret,每个持久化的值都使用 write_env,仅对 CI 实际需要的值使用 set_secret,在任何不可逆操作前使用 confirm。每个 stage 都会清屏,使当前步骤成为唯一可见内容——让一个阶段只做一件事,这样人类需要的东西就不会滚出视野。不要触碰标记上方的库代码。

4. 验证并移交

  • bash -n <script>;如果可用则运行 shellcheck
  • chmod +x <script>
  • 不要自己端到端运行——它会打开浏览器并阻塞等待人类输入。改为静态跟踪:步骤 1 中的每个值都被捕获并写入步骤 1 指定的位置,并且每个 set_secret 名称精确匹配 CI 中的 secrets.* 引用。
  • 告诉用户如何运行它。如果这是一个可重复的设置路径,提交它并在 README 中链接,这样下一个人就能直接运行脚本,而不是求助 AI。
Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 45 lines · 71 tokens per session scan A 2855874fd345

Subscribe to this mod's changes

wizard is a skill published in the GitHub repository devcxl/mattpocock-skills-zh (329 stars, last pushed 4d ago), licensed MIT. It adds 71 tokens to every session and 1,130 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.