Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DongLiStudio/personal-agent-foundation --skill install-agent-scaffoldgit clone --depth 1 https://github.com/DongLiStudio/personal-agent-foundationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/donglistudio/personal-agent-foundation/install-agent-scaffold)<a href="https://agentmods.dev/skills/donglistudio/personal-agent-foundation/install-agent-scaffold"><img src="https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/install-agent-scaffold/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/donglistudio/personal-agent-foundation/install-agent-scaffold"><img src="https://agentmods.dev/badge/skills/donglistudio/personal-agent-foundation/install-agent-scaffold.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.02953 |
| Opus 5 | $0.00060 | $0.01477 |
| Sonnet 5 | $0.00024 | $0.00591 |
| Haiku 4.5 | $0.00012 | $0.00295 |
Grade A, and why
install-agent-scaffold scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
安装 Personal Agent Foundation
把本 Skill 当作安装协调器；把 scripts/scaffold_guard.py 当作模板文件操作的唯一确定性实现。不要用临时 shell 替代占位符校验、渲染或目标保护。
读取契约
开始前读取：
references/installation-workflow.md：安装阶段、配置格式和验收门禁。references/host-integration.md：不同 Agent 的 Skill 与全局提示词边界。references/onboarding.md：安装后首次项目教程。
用户配置真实 Obsidian Vault 时，再完整读取 references/obsidian-layout.md，执行结构访谈、访问边界确认和链接验收。
不要要求用户预先克隆仓库、安装本 Skill、提供产品本地路径或准备 Python。先定位当前 Skill 是否已处于完整产品仓库；如果没有，按 references/installation-workflow.md 自动把官方仓库获取到新的系统临时目录。确认实际产品根目录存在 template/、template-manifest.json 和本 Skill 的完整目录后再继续。
交互原则
- 宿主提供图形化提问、选择目录、选项卡片、可视化安装面板或确认能力时优先使用；界面由宿主 Agent 生成，本产品不实现独立 GUI。当前宿主可用时必须优先尝试可视化安装面板或确认摘要；失败或不可用时说明原因，再退回普通对话。
- 没有图形能力时使用普通对话逐项收集。
- 安装是一个连续状态机，不因用户插入其他话题而丢失进度。每次回复都应维护当前阶段、已完成证据、下一门禁和待用户确认项；用户说起其他事情时，先判断是补充安装信息、暂停安装、还是无关插话。无关插话只简短回应并回到当前安装阶段；用户明确暂停时，输出可恢复检查点和下一条恢复指令。
- 已有明确答案不重复询问；路径、连接意图和外部身份在执行前回读确认。
- 交互式安装面板、确认摘要、dry-run、目标保护、外部授权、依赖安装、链接创建、Git 初始化、onboarding 和清理收尾都继承同一套约束；越到后面越不能省略确认、回读和证据。任何阶段准备执行写入、授权、系统依赖、链接、Git 或外部操作前，都要重新展示影响范围并获得对应确认。
- 创建通用助手总经理或业务项目总经理等长期会话/任务前，必须先引导用户打开、添加或导入对应项目目录，并确认该会话绑定到正确项目根。不得先创建或重命名长期任务来替代打开项目；宿主没有自动添加项目接口时，先给出手动打开步骤并等待用户确认。独立长期任务只允许作为用户明确选择的降级路径，启动指令必须要求先核验项目根目录、cwd 和三入口文件。
- 初始安装阶段不得询问用户飞书 Profile 名、GitHub 账号名或 Obsidian Vault 路径；普通用户不应被要求知道这些实现标识。先安装 GLOBAL 和 Skills，再调用
feishu-profile、github-cli等能力完成授权、验证码或网页登录，并以工具回读结果写回 GLOBAL。Obsidian Vault 路径只在连接阶段作为临时输入使用，不进入模板渲染配置。 - 飞书首次连接默认创建新的飞书应用和新的专用 Profile；不得自动复用本机已有 Profile、active Profile、旧应用或其他项目应用。已有 Profile 只能只读检查命名冲突；复用只允许作为用户明确选择的高级迁移/共用路径，并在执行前说明会共享原应用权限、身份路由和审计边界。
- 身份写回不得由程序自拟展示名称。飞书公司列表标题和公司名称必须使用授权回读或用户确认的真实公司/租户名称，CLI profile 名只作为命令参数；GitHub 账号列表必须使用
gh api user回读的真实 login/账号名称。 - 不得把飞书、GitHub 或 Obsidian 静默设为“未配置”。GLOBAL 和 Skills 恢复后，必须分别询问用户是否现在连接；交互界面的默认推荐和预选项应为“现在连接”。用户明确选择暂不连接、当前没有账号或当前没有 Vault 后，才可保留未配置说明。
- 默认推荐的 Agent 根目录最终文件夹名为
Agent。先说明推荐理由：便于跨宿主识别、迁移、GLOBAL 与项目同级管理；用户可以指定其他空目录。目标不存在时创建，目标已存在且为空时使用，目标包含已有文件时停止并说明不会合并或覆盖。 - 不收集、写入或回显 token、密码、App Secret、私钥和恢复码。
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 78 lines · 119 tokens per session scan A c0c6eff7b015
install-agent-scaffold is a skill published in the GitHub repository DongLiStudio/personal-agent-foundation (11 stars, last pushed 24d ago), licensed Apache-2.0. It adds 119 tokens to every session and 2,953 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
harbor-daytona
Use Harbor's Daytona sandbox platform for computer use — creating sandboxes, taking screenshots, sending mouse/keyboard input, and building agent loops. Use when the user wants to interact with a GUI, automate a desktop, do computer use, control a browser visually, or run Claude computer use against a Daytona sandbox.
boost-modules
Skill "boost-modules" from av/harbor, covering harbor boost custom modules, module structure, quick reference, output methods and stream text to client.
token-usage
Nested swiss-knife reference for token usage, cost, cache, and tool-call/API-call reports. Use for model cost reports, cache rates, budget/burn analysis, and tools-per-API-call trends across LingTai logs.
langgraph
LangGraph 1.x (LTS) Python workflow patterns for state management, delta channels, resilience (node timeouts, error handlers, graceful drain), routing, parallel execution, supervisor-worker, tool calling, checkpointing, human-in-loop, streaming (v2 format), subgraphs, and functional API. Use when building LangGraph…
security-arsenal
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding…
lc-curate-context
Decide which files a task actually needs, record that as a reusable llm-context rule, verify it against the codebase - including the files your selection references but leaves out - and pack it for your own context, a chat, or a sub-agent you dispatch. Load when choosing what code to put in front of a model, packing…