Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ggg123124/vrchat-assistant --skill vrchat-group-queriesgit clone --depth 1 https://github.com/ggg123124/vrchat-assistantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ggg123124/vrchat-assistant/vrchat-group-queries)<a href="https://agentmods.dev/skills/ggg123124/vrchat-assistant/vrchat-group-queries"><img src="https://agentmods.dev/badge/skills/ggg123124/vrchat-assistant/vrchat-group-queries/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ggg123124/vrchat-assistant/vrchat-group-queries"><img src="https://agentmods.dev/badge/skills/ggg123124/vrchat-assistant/vrchat-group-queries.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 48 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Data Exfiltration · line 27 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.01284 |
| Opus 5 | $0.00009 | $0.00642 |
| Sonnet 5 | $0.00004 | $0.00257 |
| Haiku 4.5 | $0.00002 | $0.00128 |
Grade A, and why
vrchat-group-queries scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
用户问"XX 群组有没有开房/集会安排/我加了哪些群组"时，直接走群组工具，不要用裸 curl 探测端点： How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VRChat 群组域 — 查询与操作
本 skill 覆盖 vrc-monitor 的群组域：群组查询、公告读取、403 分诊、加入/退出/窥探。
⚠️ 工具表唯一权威在 vrc-monitor-agent skill。本 skill 只写工作流与域内细节，不复制工具表。通用 MCP 调用陷阱见 vrc-monitor-agent「常见陷阱」。 MCP 端点：
http://127.0.0.1:8799/mcp；服务未启动处理见 vrc-monitor-agent「服务健康检查」。
1. 群组查询
用户问"XX 群组有没有开房/集会安排/我加了哪些群组"时，直接走群组工具，不要用裸 curl 探测端点：
1. get_user_groups() → 我/某人加入了哪些群组（`userId` 可选，省略 = 当前账号；`withDetails: true` 批量带简介）
2. get_group_info(groupId) → 群组详情（成员数/描述/joinState；`includeAnnouncement: true` 附带公告，非成员 null）
3. get_group_instances(groupId) → 群组当前开的房（空 [] = 没开房；返回 worldName/人数）
4. get_group_announcement(groupId) → 群组公告（活动安排/集会日期）
5. **查群主/创建人**：`get_group_info` **不含 ownerId**——裸 API `GET https://api.vrchat.cloud/api/1/groups/{groupId}`（Cookie: auth=… 从 data/auth_cookie.txt 读，UA 必带）返回完整对象，含 `ownerId`/`createdAt`/`onlineMemberCount`/`rules` 等 MCP 工具没暴露的字段；再 `get_friend_info(ownerId)` 调出群主资料
陷阱：
- 端点：
GET /auth/user/groups→ 404 不存在；正确端点是GET /users/{userId}/groups - ⚠️ 群组搜索 API 参数：
GET /groups?search=<关键词>是废参数——返回固定无关列表，完全忽略关键词。正确参数是query：GET /groups?query=<关键词>&n=30。判断依据：结果是否和关键词相关，无关先怀疑参数名而不是"群不可搜索" - 可查任意用户：
get_user_groups传别人 userId 一样能查（群组列表默认公开），共同群组可做社交画像 get_group_heat：群组房活动热度榜（活动次数/活跃好友/世界数/成员数/趋势）+ topK 群热力图；grp_/gmem_兼容
2. 群组公告 403 的两种性质
公告 403 别一看到就当故障，先分性质：
- 非成员群必 403（响应体
You're not a member.）= VRChat 规则，查非成员群的公告就是拿不到——正常业务。想查别人的私人小群公告，提前预期会失败 - 成员群偶发瞬时 403 = 限流/抖动（同 cookie 直连 API 却是 200）。诊断法：urllib 直连
GET /groups/{id}/announcement（data/auth_cookie.txt + UA），换 UA 也是 200 → 排除 UA/WAF 因素 → 瞬时抖动，重试即好 - 工具已对 403/404 返回
{groupId, announcement: null}不抛错
3. join / leave / peek
"能提前判断某群能不能直接加入吗？"：能。get_group_info 返回的 joinState 就是答案——open=直接加入、request=需审核、invite=仅邀请。
join_group {groupId}：open 群直接加入；已是成员返回alreadyMember:true不报错（400 幂等安全）leave_group {groupId}：自己退出用POST /groups/{id}/leave（DELETE /members/{userId}是管理员移除成员，普通成员 403——实测踩坑）。必须confirm: true，否则只返回预览peek_group_announcement {groupId, confirm:true}：一键「加入→读公告→退出」，仅对 open 群生效（request/invite 返回 peekable:false）；必须 confirm 防误触自动加群
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 54 lines · 18 tokens per session scan A 43aaf9ded13d
vrchat-group-queries is a skill published in the GitHub repository ggg123124/vrchat-assistant (21 stars, last pushed yesterday), licensed MIT. It adds 18 tokens to every session and 1,284 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
macos-app-automation
Use this skill when the user asks whether Hermes can control a native macOS app, or asks you to verify, configure, or troubleshoot AppleScript/Automation access for an app.
holix-cron
Schedule recurring agent tasks via Holix built-in gateway cron (not crontab or custom scripts).
pebble-setup
Install, update, launch, and talk to Pebble — the PWA chat interface — from a Hermes agent.
libretranslate-markdown-i18n
Machine-translate Markdown / Obsidian / Quartz content into other languages using a self-hosted LibreTranslate instance, preserving frontmatter, headings, emojis, bold/italic, wikilinks (![[...]]/[[...]]) and internal links. Use whenever a user wants to auto-translate a Markdown vault, Obsidian notes, or a…
weekly-report
One weekly report combining Super Productivity time per project/task (with week-over-week deltas), Obsidian notes of the week grouped by folder (with key bullet points), emails sent this week, calendar events, git commits per repo, Claude Code sessions per project, and Umami page visits vs last week — with a skimmable…
emailops
Query, search, chat with, and compose/draft/send email from a local EmailOps mailbox via emailops-cli.