Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hanzhcn/laohan-skills --skill laohan-gengxingit clone --depth 1 https://github.com/hanzhcn/laohan-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-gengxin)<a href="https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-gengxin"><img src="https://agentmods.dev/badge/skills/hanzhcn/laohan-skills/laohan-gengxin/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-gengxin"><img src="https://agentmods.dev/badge/skills/hanzhcn/laohan-skills/laohan-gengxin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 83 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.01129 |
| Opus 5 | $0.00044 | $0.00564 |
| Sonnet 5 | $0.00017 | $0.00226 |
| Haiku 4.5 | $0.00009 | $0.00113 |
Grade A, and why
laohan-gengxin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
工具版本检查与更新
扫描所有常用工具的版本状态，生成编号报告，等待选择后逐项更新。
核心理念
只检查不自动更新——报告给用户看，确认后才动。因为盲目更新可能破坏环境（openclaw 升级后需补装依赖、插件升级后需重启），每次更新都要用户知情。
不适用场景
- 只检查单个工具版本 → 直接跑
--version或npm view <pkg> version，不需要本 skill - 安装新工具 → 用
brew install/npm install/uv tool install，不走更新流程
工作流程
第0步：发现遗漏
跑 scripts/discover.sh，全量扫描系统（npm/brew/pip/uv/conda/local-bin），过滤依赖库后与 tools.json 做差集。如果有新发现的工具，报告给用户确认是否加入。
发现方法论的完整说明见 references/scan-methodology.md。
第1步：读取工具清单
读取 references/tools.json，获取所有工具的检查方式和更新命令。
第2步：逐项检查版本
按分类并行执行检查命令，对比已装版本和最新版本。检查逻辑：
| 检查源 | 命令 | 说明 |
|---|---|---|
| npm | npm view <pkg> version |
npm registry 最新版 |
| brew | brew outdated --json=v2 |
Homebrew 过期检查 |
| pip | pip3 index versions <pkg> |
PyPI 最新版 |
| uv | pip3 index versions <pkg> |
PyPI（uv tool 安装的也能查） |
| gh release | gh api repos/<owner>/<repo>/releases/latest --jq .tag_name |
GitHub release |
| claude plugins | claude plugins list --json |
插件市场版本 |
第3步：生成编号报告
固定格式，每条一行：
[编号] [分类] [状态标记] [名字]
已装: x.x.x → 最新: y.y.y
作用: 中文说明
频繁度: 高/中/低 | 推荐更新: 是/否 | 推荐卸载: 是/否
更新方式: 具体命令
重大变化: (如果有)
状态标记：
- ✅ 最新
- ⬆️ 落后（推荐更新）
- ⚠️ 落后很多（跨大版本）
- ❓ 未知（检查失败）
分类：核心平台 | npm包 | Homebrew | Python | uv工具 | 插件 | Skills | 运行时
第4步：等待用户选择
报告末尾提示：
输入要更新的编号（用逗号或空格分隔），或输入 "all" 全部更新，"q" 退出：
第5步：执行更新
用户给出编号后，按编号顺序逐项执行对应的更新命令。每项更新完成后报告结果（成功/失败）。
注意事项：
- openclaw 更新后需跑维护清单（见下方）
- brew 用
brew reinstall不用brew upgrade（国内镜像缓存同步延迟） - npm 更新后不用
--force - pip 用
pip3 install --upgrade或uv pip install --upgrade - 插件更新后需重启 Claude Code session
- skills 用
npx skills update -g -y全量更新（不支持单个更新）
openclaw 更新后维护清单
如果用户更新了 openclaw，提醒执行：
# 1. 健康检查超时补丁
~/.openclaw/scripts/patch-health-timeout.sh
# 2. 补装 memory 依赖
DEPS_DIR=$(ls -td ~/.openclaw/plugin-runtime-deps/openclaw-*/ | head -1)
cd "$DEPS_DIR" && npm install [email protected] sqlite-vec
# 3. 重启 gateway
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway
# 4. 等60秒冷启动后验证
sleep 60 && openclaw status
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 110 lines · 87 tokens per session scan A 2b9225a8b76c
laohan-gengxin is a skill published in the GitHub repository hanzhcn/laohan-skills (11 stars, last pushed today), licensed MIT. It adds 87 tokens to every session and 1,129 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lark-vc-agent
A meeting assistant for Feishu video calls that can join or leave an ongoing meeting, read visible live events, and send text or reactions. Feishu is a workplace collaboration platform.
wechat-business-news-cron
Set up recurring morning/evening news digests delivered to WeChat or Feishu via Hermes cron jobs, with manual timezone conversion, duplicate-job cleanup, and a polished Chinese business-brief card format.
gog
Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.
notion
Notion API for creating and managing pages, databases, and blocks.
beautiful-feishu-card
Generate modern, elegant, and highly readable Feishu Interactive Cards (Schema 2.0 JSON) wrapped for CardKit (.card). Uses strict design system rules: 12 header color themes, color palette harmony (≤3 main colors), structured layouts (columnset, dividers, callout markdown), interactive preview messaging via lark-cli…
auto-updater
Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of what changed.