Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/FlanChanXwO/pixiv-clinpx agentmods add skills/flanchanxwo/pixiv-cli/pixiv-cli-ciWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/flanchanxwo/pixiv-cli/pixiv-cli-ci)<a href="https://agentmods.dev/skills/flanchanxwo/pixiv-cli/pixiv-cli-ci"><img src="https://agentmods.dev/badge/skills/flanchanxwo/pixiv-cli/pixiv-cli-ci/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/flanchanxwo/pixiv-cli/pixiv-cli-ci"><img src="https://agentmods.dev/badge/skills/flanchanxwo/pixiv-cli/pixiv-cli-ci.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.02025 |
| Opus 5 | $0.00041 | $0.01012 |
| Sonnet 5 | $0.00016 | $0.00405 |
| Haiku 4.5 | $0.00008 | $0.00202 |
Grade A, and why
pixiv-cli-ci scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pixiv-cli CI 与 workflow
按仓库维护流程诊断和验证 CI。先读取 AGENTS.md、docs/zh-CN/maintainers/development.md、目标
workflow、对应 scripts/cmd/* policy 和 scripts/tests 归属；默认只读，先获得证据再决定是否需要改代码或重跑。
安全边界
- 查看 PR、run、job、step、日志和本地 policy 是只读操作；重跑、取消、dispatch、修改 workflow、push 或修复代码前取得用户对具体动作的明确授权。
- 不把 token、Cookie、签名私钥、代理凭据、私有 URL、下载作品、本地状态或 API response 写入日志、issue、PR 或最终报告；日志中发现 secret 时只报告脱敏位置。
- 不用 rerun 把代码/策略失败伪装成通过。重跑成功只能证明该次执行通过，必须保留原失败原因和 run/attempt 链接。
.github/workflows/release.yml只接受push.tags: v[0-9]*；不要对它调用gh workflow run，不要移动旧 tag、向 tag 注入默认分支新内容或手工绕过 release gate。- 不为解决“运行较久”凭空增加 timeout、retry、跳过条件或 fallback；区分真实无响应、基础设施故障、代码失败和正常长任务。
识别准确的 run 和提交
-
先确定仓库、PR/branch、workflow、run ID、attempt、head SHA 和默认分支；不要根据标题猜 run：
gh pr checks <number> --required --json name,state,bucket,workflow,link gh run list --workflow <workflow-file> --limit 20 gh run view <run-id> --json name,event,headBranch,headSha,status,conclusion,jobs,url -
PR 检查未完成时使用：
gh pr checks <number> --required --watch --fail-fast对单个 run 使用：
gh run watch <run-id> --compact --exit-status gh run view <run-id> --log-failed记录失败的 job、step、命令、head SHA、workflow ref 和首次错误；不要只摘最后一行。
-
失败日志不足时查询具体 job ID：
gh run view <run-id> --json jobs \ --jq '.jobs[] | {name, databaseId, status, conclusion}' gh run view --job <job-database-id> --log-failed将 GitHub API 的网络/权限失败与 workflow 本身失败分开报告。
本地门禁选择
先根据 diff 分类，不要无依据地把所有门禁都扩展到每个小改动：
| 范围 | 最小验证 |
|---|---|
| README/docs/agent-only | go test ./scripts/tests/documentation -count=1、git diff --check |
| Go 或行为代码 | 聚焦测试；随后 go test ./... -count=1、go vet ./...，构建相关时运行 sh scripts/build.sh |
| 共享、认证、下载、CLI、MCP、SDK | 另跑 go test -race ./... -count=1 |
| scripts、workflow、release policy | go test ./scripts/... -count=1、go vet ./scripts/...，以及受影响的 policy/test carrier |
| shell 脚本 | 对保留脚本运行 sh -n；不要只依赖 YAML 解析 |
| 真实 Pixiv/FANBOX API、native host、Keychain/DPAPI 或受保护 release evidence | 只有用户显式授权并具备对应环境才运行；否则记录未运行和风险 |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 137 lines · 82 tokens per session scan A 1ffbc2a4bae1
pixiv-cli-ci is a skill published in the GitHub repository FlanChanXwO/pixiv-cli (131 stars, last pushed yesterday), licensed MIT. It adds 82 tokens to every session and 2,025 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gh-skill
Manage agent skills with gh skill. Use this skill to discover, preview, install, update, and publish Agent Skills so an agent can self-manage the skills available in its environment.
gh
Patterns for invoking the GitHub CLI (gh) from agents. Covers structured output, pagination, repo targeting, search vs list, gh api fallback.
hunk-extensions
Maps the hunkdiff/extension authoring surface for Hunk, the terminal diff viewer — hiding or reordering reviewed files, docked panes, alternate file views, commands and key bindings, dialogs, workspace writes, themes, syntax languages, VCS backends, lifecycle events. Use when writing, debugging, or installing a Hunk…
printing-press-polish
Polish a generated CLI to pass verification and become publish-ready. Runs diagnostics (dogfood, verify, scorecard, go vet, gosec), automatically fixes all issues (verify failures, static-analysis findings, dead code, descriptions, README, MCP tool quality), reports the before/after delta, and offers to publish. Use…
printing-press-amend
Amend a published CLI from one of two input sources: (1) dogfood mode mines the active Claude Code session transcript for friction (missing flags, hand- rolled API payloads, silent-null returns); (2) direct-input mode accepts user-supplied asks (rename a command, add commands or feeds, fix a named bug, optionally…
printing-press-output-review
Internal sub-skill: agentic review of a printed CLI's sampled command output for plausibility issues that rule-based checks can't encode (substring-match relevance, format bugs, silent source drops, ranking failures). Invoked via the Skill tool by the main printing-press skill at Phase 4.85 and printing-press-polish…