Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DongLiStudio/personal-agent-foundation --skill allinssl-certificate-automationgit clone --depth 1 https://github.com/DongLiStudio/personal-agent-foundationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/donglistudio/personal-agent-foundation/allinssl-certificate-automation)<a href="https://agentmods.dev/skills/donglistudio/personal-agent-foundation/allinssl-certificate-automation"><img src="https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/allinssl-certificate-automation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/donglistudio/personal-agent-foundation/allinssl-certificate-automation"><img src="https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/allinssl-certificate-automation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.01950 |
| Opus 5.5 | $0.00028 | $0.00780 |
| Sonnet 5.5 | $0.00014 | $0.00390 |
| Haiku 4.5 | $0.00007 | $0.00195 |
Grade A, and why
allinssl-certificate-automation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ALLinSSL 证书自动化
工作起点与依赖
读取当前项目 AGENTS.md、README.md、STATUS.md 和声明的 GLOBAL 入口。项目存放域名、目标服务、授权引用与验收记录；全局 Skill 只维护通用流程。
先定位长期使用的 ALLinSSL 控制中心：
- 读取 GLOBAL 服务器索引和当前项目明确路由的服务器详情。没有已登记服务器时，先与用户协商长期宿主并按
server-profile完成接入；不得自行选购、接入或部署服务器。 - 有已登记服务器时，先根据服务索引找出部署了 ALLinSSL 的候选服务器，再仅对项目相关候选执行最小只读在线核验；不扫描无关服务器。
- 发现一个合适实例时，核验版本、持久化与备份、长期在线性、API 接入、通知能力以及到 DNS 和部署目标的网络可达性，满足要求就复用。
- 发现多个实例时，依据项目现有引用、稳定性和权限边界选定唯一主实例；不得为本次任务自动新建另一个控制中心。
- 未发现实例或现有实例不适合长期使用时，整理候选宿主、部署方式、持久化、备份和网络影响，与用户确认长期宿主及部署授权；确认前不安装 ALLinSSL。
先确认已有授权，继续用户已允许的部署与配置工作，不重复询问已有决定。发现缺少必要信息或权限时尽早询问，同时完成独立的准备工作。Skill 本身不授权云资源变更、安装服务、重启、修改其他项目或发送消息。
按范围调用已安装的 server-profile、tencentcloud-profile、aliyun-profile；宿主没有这些 Skill 时按项目规则完成同样的身份和指纹核验，不假定工具已存在。腾讯云/DNSPod 是适配方案，不是强制依赖；DNS 权限与云主机权限分别核验。
操作 API 时读 安全接入与 API；涉及服务端、DNS 或部署时读 部署与失败保障；验收或迁移时读 验收与恢复。
最小输入与缺项处理
| 输入 | 必须确认的事实 | 缺失时 |
|---|---|---|
| ALLinSSL 接入 | 已登记服务器、现有实例位置、版本、宿主/容器、API Key 可用性及允许的安全读取方式 | 先发现并复用合适实例；没有合适实例时与用户确认长期宿主和部署授权，再完成安全 API 接入；不得索要聊天明文密钥 |
| 域名与 DNS | 所有对外域名、DNS 托管方、真实账号主体、zone 权限、记录现状与目标地址 | 引导授权；授权不能替代域名列表查询 |
| 部署目标 | 唯一服务器 Profile、可信指纹、SSH 主体、实际 TLS 入口与证书路径 | 补齐连接；按本次部署授权准备入口 |
| 通知源 | 至少两个不同的可用 report/channel ID，接收方与项目范围明确 | 要求用户提供或授权配置缺少的来源 |
| 业务入口 | 服务后端、公开范围、端口、HTTP/WSS 等功能及回退方法 | 不猜测或覆盖既有站点 |
已有通知源先核验，只有用户授权本项目复用后才接入；不因名称带其他项目而一律阻止用户明确指定的复用，也不自行跨租户复用。优先选择不同传输渠道（例如飞书与邮件），两个节点引用同一个渠道不算两个来源。
缺少两个来源时不能宣称完整上线、不能新启用无人值守流程；已运行的流程不得因此擅自停用，报告缺口并继续其余授权工作。
默认策略
这是用户确定的工作流默认值；用户当前明确指令或项目显式覆盖优先，覆盖项写入项目记录。双来源要求除非用户明确决定例外，否则保持。
| 项目 | 默认值 |
|---|---|
| CA | Let's Encrypt；标识和 ACME 端点以目标版本为准 |
| 续期 | 剩余有效期不足 30 天进入续期；正确设置目标版本的 end_day 字段与边界语义 |
| 调度 | 每日检查一次，选择不拥挤的时段并明确时区 |
| ARI | 版本支持时启用；核查与 30 天阈值的实际交互，不假定固定时点必签发 |
| 密钥算法 | RSA2048；按入口兼容性和项目要求选择 ECDSA |
| DNS 验证 | DNS-01，使用受限域名/zone 权限 |
| SSH | 每服务器独立的 ALLinSSL 专用密钥，优先受限部署用户 |
| 失败通知 | 至少两个来源，覆盖申请和每个部署目标的失败 |
| HTTPS 证书监控 | 每个对外域名覆盖至少两个来源；5 分钟检查、提前 25 天提醒、重复间隔 10 分钟 |
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 76 lines · 71 tokens per session scan A 505850b160fc
allinssl-certificate-automation is a skill published in the GitHub repository DongLiStudio/personal-agent-foundation (16 stars, last pushed yesterday), licensed Apache-2.0. It adds 71 tokens to every session and 1,950 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other skills, from other repositories
incident-response-skill
A skill that uses object-style tool references with purpose descriptions and required flags, plus strict validation.
hosting
Hostinger Hosting API for website management, order listing, datacenter selection, domain verification, free subdomains, databases, subdomains, parked domains, Node.js applications, and WordPress installs. Use when creating websites, listing hosting orders, choosing datacenters, verifying domain ownership, managing…
vps
Hostinger VPS API for virtual machine management, Docker projects, firewalls, SSH keys, backups, snapshots, OS templates, post-install scripts, recovery mode, malware scanning, PTR records, and metrics. Use when creating, managing, or troubleshooting VPS instances, deploying Docker containers, configuring firewalls…
dns
Hostinger DNS API for zone record management, snapshots, and validation. Use when creating, updating, or deleting DNS records, restoring DNS snapshots, validating zone changes, or resetting DNS to defaults.
gke-compute-classes
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…
gke-reliability
Improves GKE workload reliability, using PDBs, health probes, and topology spread constraints. Use when configuring GKE workload reliability, setting up PDBs, or configuring GKE health probes (liveness, readiness, startup). Don't use for generating K8s YAML manifests (use gke-manifest-generation) or disaster recovery…