Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ggg123124/vrchat-assistant --skill vrchat-assistant-developmentgit clone --depth 1 https://github.com/ggg123124/vrchat-assistantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ggg123124/vrchat-assistant/vrchat-assistant-development)<a href="https://agentmods.dev/skills/ggg123124/vrchat-assistant/vrchat-assistant-development"><img src="https://agentmods.dev/badge/skills/ggg123124/vrchat-assistant/vrchat-assistant-development.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 64 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 80 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 64 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01665 |
| Opus 5 | $0.00023 | $0.00833 |
| Sonnet 5 | $0.00009 | $0.00333 |
| Haiku 4.5 | $0.00005 | $0.00167 |
Grade A, and why
vrchat-assistant-development scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. 开发完成 → **实际运行验证**（`node start-monitor.js` + `/health`；相关 `test-*.mjs` 脚本；新工具用 curl 走一遍真实 MCP 调用） How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vrchat-assistant 开发 Skill — 新增功能 / 修改功能 / 提交 PR
本 skill 面向任何 AI Agent：当使用者要求给 vrchat-assistant 添加新功能、修改现有功能、修复 bug，或提交 PR 时使用。
触发条件
- 使用者说"给 vrchat-assistant 加个功能 / 做个工具 / 改一下 XX 行为"
- 使用者要求在仓库内新增脚本、MCP 工具、数据库字段、定时任务
- 使用者要求修复 bug 并提交 issue + PR
- 任何对
core/、start-monitor.js、hermes-plugin/、desktop/下代码的修改
⚠️ Phase 0（强制）：检查仓库归属
动手之前先确认当前仓库是用户自己的 Fork，不是中央仓库。 开发/修改功能必须发生在用户自己的仓库里：
git remote get-url origin
- 若 origin 指向
ggg123124/vrchat-assistant（中央仓库）→ 停止开发，提示用户先创建自己的仓库（Fork 中央仓库），再克隆 Fork 继续。不要直接在中央仓库 clone 上开发——Agent 的代码变更无法推送、且可能污染上游 - 若 origin 指向用户自己的账号（如
https://github.com/<用户名>/vrchat-assistant.git）→ 正常继续 - 检查是否有 upstream：
git remote -v应显示upstream → https://github.com/ggg123124/vrchat-assistant.git（fork 来源，用于同步官方更新git pull upstream main）。缺 upstream 时提示可补，但不阻塞开发
Fork & Clone 完整流程见 AGENTS.md「获取代码（Fork & Clone）」章节。
⚠️ 第二步（强制）：读取权威开发规范
动手写任何代码之前，先完整读取仓库根 DEVELOPMENT.md——它是开发规范的唯一权威来源，作者会持续维护，可能与本 skill 的编写时间不同步。禁止凭记忆或凭本 skill 的概述代替它。
cd <仓库根目录> # 即本仓库 clone 下来的位置
cat DEVELOPMENT.md # 或 read_file
读取顺序建议：README.md（概览）→ AGENTS.md（部署）→ ARCHITECTURE.md（架构）→ DEVELOPMENT.md（开发约束，§3 跨平台必读）。每次开发任务都重新读，不假设内容与上次相同。
本 skill 只负责「流程编排 + 仓库导航」，规范正文以仓库文件为准。若发现 DEVELOPMENT.md 与本 skill 描述冲突，以 DEVELOPMENT.md 为准。
总体原则（概述，细节见 DEVELOPMENT.md）
- AI 完成开发，人类只提需求：使用者不直接编码。流程 = 需求 → 读文档 → 实现 → 自测 → 使用者验收 →（可选）PR
- 新功能默认做成 MCP 工具，禁止只写孤立 CLI 脚本（Agent 通过 MCP
tools/call与功能交互） - 身份表达：issue / PR / commit 一律以 AI Agent 口吻书写，不冒用使用者人称（"使用者提出…"而非"我需要…"）
- fork 自由、PR 自愿；发现缺陷是义务，必须主动上报（issue + 修复 PR）
仓库导航（在哪里改）
新增一个 MCP 工具的注册位置（细节规范见 DEVELOPMENT.md §5）：
| 组件 | 位置 | 说明 |
|---|---|---|
| 核心工具 def | core/tools/<域>.js |
文件默认导出 tools 数组（自声明 name + description + inputSchema + handler），启动时经 core/registry.js 注册 |
| 插件能力 def | plugins/official/<域>/index.js |
默认导出 register(api)，经 api.registerTool 定义工具；数据/能力经 api.consume / api.vrchat.fetch 复用核心 |
| 注册表 | core/registry.js |
按 core/tool-order.json 混合索引核心 + 插件工具，提供 listTools / dispatch |
| 文档登记 | skills/vrc-monitor-agent/SKILL.md「MCP 工具」表格 |
权威登记位置（2026-08-15 起 README 不再平铺工具清单；AGENTS.md §6 采样列举同步补名；BOOTH 域另登记 skills/booth-query-display/SKILL.md） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 84 lines · 46 tokens per session scan A 373784f24e66
vrchat-assistant-development is a skill published in the GitHub repository ggg123124/vrchat-assistant (21 stars, last pushed yesterday), licensed MIT. It adds 46 tokens to every session and 1,665 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mnemosyne
Persistent cross-session memory via Mnemosyne — store, recall, and consolidate facts, preferences, and context.
mnemosyne-memory-override
Hard rule override that forces Mnemosyne for all durable memory storage. The legacy memory tool is DEPRECATED for user preferences, credentials, and project conventions. Use memory ONLY for ephemeral session state.
hermes-tweet
Use Xquik in Hermes Agent for public X research, monitoring, thread summaries, creator discovery & approved actions. Not affiliated with X Corp. Use when the user requests X data or a named action. Trigger with "search X", "monitor X", "post tweet", or "X trends".
mnemosyne-maintenance
Use when: upgrading Mnemosyne, diagnosing slow/hung consolidation (mnemosynesleep), fixing missing embeddings, or troubleshooting import/version mismatches.
make-release
A release workflow for the Holix GitHub repository. It prepares a pull request, checks that automated tests pass, merges it, and creates the next numbered release.
holix-cron
Schedule recurring agent tasks via Holix built-in gateway cron (not crontab or custom scripts).