Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Dong90/oh-my-taiyiforge --skill taiyi-integrationgit clone --depth 1 https://github.com/Dong90/oh-my-taiyiforgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dong90/oh-my-taiyiforge/taiyi-integration)<a href="https://agentmods.dev/skills/dong90/oh-my-taiyiforge/taiyi-integration"><img src="https://agentmods.dev/badge/skills/dong90/oh-my-taiyiforge/taiyi-integration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dong90/oh-my-taiyiforge/taiyi-integration"><img src="https://agentmods.dev/badge/skills/dong90/oh-my-taiyiforge/taiyi-integration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 144 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 153 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 174 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 175 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 176 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.02698 |
| Opus 5.5 | $0.00011 | $0.01079 |
| Sonnet 5.5 | $0.00005 | $0.00540 |
| Haiku 4.5 | $0.00003 | $0.00270 |
Grade A, and why
taiyi-integration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
taiyi-integration — 闭环归档
进入本阶段前请优先读
.taiyi/changes/<slug>/PHASE-CONTEXT.md（~500 tokens），不要全量加载上游工件。
框架集成
本阶段使用以下框架：
| 框架 | 用途 | 何时加载 |
|---|---|---|
| Harness | 阶段过关（status → continue）与归档（archive） |
全程 |
| OpenSpec | archive 命令内部将 artifacts 同步到 openspec 格式 |
步骤 4 归档时（自动） |
| GStack | ship/land — 创建 PR 和部署交付链 |
归档后（可选） |
| Superpowers | finishing-a-development-branch — 分支收尾决策 |
归档后 |
Spec-Kit 和 OMO 在本阶段不涉及。
前置门禁（Pre-flight）
0.1 上游确认
- review 阶段已过关（REVIEW.md 存在，⭐ 汇总 ≥ 4.0）
- 全部测试通过（npm test / pytest / cargo test exit 0）
- git diff 与 base 分支的差异干净（无临时文件、调试日志）
0.2 Profile 判定
| Profile | 集成要求 |
|---|---|
full |
完整：integration 工件 + docs sync + 全量测试 + 归档 |
api/ui |
同 full |
lite |
同 full |
spike/micro |
简化：integration 工件 + 全量测试 + 归档，可跳过 docs sync |
nano |
极简：dev 后直接进入 integration 工件 + 归档（可省略 docs sync） |
0.3 前置检查清单
- REVIEW.md 存在且无 Open critical findings
- 所有测试通过（实跑确认）
- 无未提交的改动
步骤
工件契约
| 层 | 路径 | 职责 |
|---|---|---|
| 语义真源 | integration.json |
Zod（src/schemas/integration.ts） |
| 生成视图 | CHANGELOG.md（变更目录内） |
hbs（src/templates/integration.hbs） |
| 流程 | 本 Skill | docs sync、全量测试、archive |
工作流：编辑 integration.json → render <slug> integration → continue → archive。
与项目根 CHANGELOG.md 分开；archive 可合并到根。详见 docs/taiyi/artifact-contract.md。
json 字段（Zod 摘要）
| 字段 | 要求 |
|---|---|
title |
集成标题 |
changelog_entries |
≥1 条；type（feat/fix/…）+ description |
release_version / release_date / status |
可选 |
breaking_changes |
可选 |
alerts / monitoring / post_launch |
可选；上线观察 |
rollback_trigger / rollback_step1 … |
可选 |
0. Integration 工件（引擎过关必填 · 变更目录）
与项目根 CHANGELOG.md 分开 — 过关校验的是变更目录内工件：
| 路径 | 用途 |
|---|---|
.taiyi/changes/<slug>/integration.json |
Zod 真源（changelog_entries 等；缺则 status 报 blockers） |
.taiyi/changes/<slug>/CHANGELOG.md |
hbs 从 json 渲染的 Keep a Changelog 切片 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 221 lines · 27 tokens per session scan A 836ee7dd3c07
taiyi-integration is a skill published in the GitHub repository Dong90/oh-my-taiyiforge (859 stars, last pushed 15d ago), licensed MIT. It adds 27 tokens to every session and 2,698 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github
GitHub via gh CLI: PRs, issues, reviews, repos, auth.
changelog
Turn a range of commits or merged PRs into a changelog entry grouped by change type. Use when the user asks for release notes, a changelog, or "what changed" between two points.
otto-drive-pr
PR mergeability, CI, and live preview.
goal-release
Cut a release end to end: use the draft-release skill to open the release PR and draft GitHub release, wait for CI to turn green, run the merge-pr skill to merge the release PR, then update the Homebrew formula from the published release assets. Use when the user wants to draft and merge a release in one go, or…
flow-next-land
Resolve feedback and CI for one named pull request, then merge when authorized and ready. Emits LANDVERDICT. Use when asked to land a pull request.
changelog
Update per-package CHANGELOG.md files for a Ratel release. Drafts entries with git-cliff (scoped per package), lets you curate, then writes the CHANGELOGs. Handles both RC entries and GA-graduation collapse (merging X.Y.Z-rc. sections into a single X.Y.Z section). Invoke before tagging a release.