Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/guyulong/cn-agent-skills/cdn-replacenpx skills add guyulong/cn-agent-skills --skill cdn-replacegit clone --depth 1 https://github.com/guyulong/cn-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/guyulong/cn-agent-skills/cdn-replace)<a href="https://agentmods.dev/skills/guyulong/cn-agent-skills/cdn-replace"><img src="https://agentmods.dev/badge/skills/guyulong/cn-agent-skills/cdn-replace.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.00741 |
| Opus 5 | $0.00014 | $0.00370 |
| Sonnet 5 | $0.00006 | $0.00148 |
| Haiku 4.5 | $0.00003 | $0.00074 |
Grade A, and why
cdn-replace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
国内 CDN 资源替换
使用场景
项目引用了 Google Fonts、Google CDN 等国内无法访问的资源时，替换为国内可用源。
重要提醒
替换 CDN 不是简单的字符串替换。 需要注意：
- 版本一致性：替换源的库版本必须与原版本一致，否则可能出现兼容性问题
- SRI 校验：如原链接有
integrity属性，替换后必须更新 SRI hash- 许可证：确认替换源分发的文件未违反原库许可证
- 可用性：第三方 CDN 随时可能下线或变更，需有备选方案
- 安全性：验证替换源未篡改文件内容
常见替换参考
以下地址仅供参考，使用前请验证版本号和可用性。
字体
| 原始 | 替换候选 |
|---|---|
fonts.googleapis.com |
fonts.loli.net / fonts.font.im |
JavaScript 库
| 原始 | 替换候选 |
|---|---|
ajax.googleapis.com |
cdn.bootcdn.net / cdn.staticfile.net |
cdn.jsdelivr.net |
cdn.bootcdn.net / cdn.staticfile.net |
cdnjs.cloudflare.com |
cdn.bootcdn.net |
unpkg.com |
cdn.bootcdn.net |
示例
/* 替换前 */
@import url('https://fonts.googleapis.com/css2?family=Noto+Sans+SC');
/* 替换后 — 确认版本一致 */
@import url('https://fonts.loli.net/css2?family=Noto+Sans+SC');
替换后务必确认版本号、子集参数等完全一致。
自动替换脚本
# 查找项目中所有引用
grep -r "googleapis\|jsdelivr\|cloudflare\|unpkg" --include="*.html" --include="*.css" --include="*.js" .
更好的方案
方案 A：自建 npm 私有源
使用 Verdaccio 等工具搭建私有 npm registry，完全控制包的来源和版本。
方案 B：自建 CDN / 静态资源服务
将依赖的库文件下载到自己的服务器或对象存储（阿里云 OSS、腾讯云 COS 等），配合 CDN 使用。
方案 C：本地打包
通过 Webpack/Vite 等工具将依赖打包到项目中，不依赖外部 CDN。这是最可靠的方案。
注意事项
- 替换后必须测试功能是否正常
- 保持版本号锁定，不要依赖 CDN 的 latest 路径
- 生产项目优先使用本地打包或自建服务
- SRI（Subresource Integrity）能防止 CDN 篡改，建议开启
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 83 lines · 28 tokens per session scan A a4ebedf27f3b
cdn-replace is a skill published in the GitHub repository guyulong/cn-agent-skills (2 stars, last pushed 2mo ago), licensed MIT. It adds 28 tokens to every session and 741 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
card-xiaohongshu
Xiaohongshu-style knowledge cards, arranged as a swipeable multi-card carousel.
data-report
Turns CSV, Excel, or JSON data into a polished visual report page.
poster-hero
Vertical poster or Moments-style share image with strong visual impact.
deck-ljg-present
把 outline 1:1 铸成色块大字宣言 deck, 原文不动只做美化。三档主题 black / red / yellow.
tcapi
Skill to call Cloud API for Tencent Cloud (腾讯云). Used for cloud automation or resource management. 当用户需要查询、创建、管理腾讯云资源，或执行云 API 自动化操作时触发。优先使用 Octop 自带 venv 中的 tccli，凭证支持全自动 OAuth 登录。.
prototype-web
可点击的功能性 Web 原型, 含导航、英雄区、特性区、CTA.