Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hanzhcn/laohan-skills --skill laohan-shenchagit clone --depth 1 https://github.com/hanzhcn/laohan-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-shencha)<a href="https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-shencha"><img src="https://agentmods.dev/badge/skills/hanzhcn/laohan-skills/laohan-shencha/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-shencha"><img src="https://agentmods.dev/badge/skills/hanzhcn/laohan-skills/laohan-shencha.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 90 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.04852 |
| Opus 5 | $0.00060 | $0.02426 |
| Sonnet 5 | $0.00024 | $0.00970 |
| Haiku 4.5 | $0.00012 | $0.00485 |
Grade A, and why
laohan-shencha scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **CLI 命令**:`(?:^|[\s]+)(docker|npm|pip|python|git|curl|cargo|go)\s[^\n]+` → `docker compose up -d` How it starts
The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Laohan Shencha(老韩深度审查)
核心原则
LLM 写技术文档时天然相信自己写的声明是对的。本 Skill 的唯一目的:找出那些“看起来正确但实际是错的”声明,并在获得授权时修正。
纯文字审查(表述矛盾、格式不统一)不是本 skill 的重点——那些靠文本比对就能发现。
模式与动作
先分别选择“核验对象”和“是否修改”,不要把二者混在一起:
TECH_CLAIMS:默认模式,用于技术文档、脚本、配置和外部资源声明。CONTENT_CLAIMS:仅在真人口播工作流⑤或用户明确要求核验口播事实时使用。RECORDED_FINAL_INPUT_GUARD + AUDIT_ONLY:仅在已录制最终稿的编排入口使用,审计是否必须重录。AUDIT_ONLY:用户说“审查、核验、看看有没有问题”时的默认动作,只出发现与证据,不改文件。VERIFY_AND_FIX:只有用户明确要求“修复、改掉”,或上游工作流合同明确授权修改时使用。
选择 CONTENT_CLAIMS 不等于降低事实标准,选择 VERIFY_AND_FIX 也不授权修改文风、方法论或与事实无关的内容。
RECORDED_FINAL_INPUT_GUARD + AUDIT_ONLY
仅当episode记录USER_PROVIDED_FINAL_SCRIPT_AND_RAW且上游Prompt明确指定RECORDED_FINAL_INPUT_GUARD + AUDIT_ONLY时启用。读取当前01-口播稿.md与06-拍摄素材/raw.mp4,分别计算SHA-256;只做不改口播的阻断性审计。普通不可核验、非核心措辞和可安全剪辑的问题写入非阻断观察后继续,不得自动回②、重跑③—⑤或伪造常规审核历史。
固定写入00-编排/recorded-input-guard.json和00-编排/recorded-input-guard.md。JSON必须为:
{
"schema_version": 1,
"mode": "RECORDED_FINAL_INPUT_GUARD",
"script_sha256": "64 lowercase hex",
"raw_sha256": "64 lowercase hex",
"status": "CLEAR_WITH_NOTES|BLOCKED_REQUIRES_RERECORD",
"blocking_reasons": [],
"non_blocking_observations": [],
"checked_at": "ISO-8601"
}
blocking_reasons只允许以下四项,且只有其中至少一项成立时状态才可为BLOCKED_REQUIRES_RERECORD:
HIGH_RISK_PLATFORM_VIOLATIONCORE_FACT_DIRECTLY_CONTRADICTEDSCRIPT_RAW_MATERIAL_MISMATCHRERECORD_ONLY_REMEDIATION
本模式不得写04-事实核验.md、04-事实主张.json或fact_check_status: CLEAR,不得编辑脚本。人类报告必须复述同一script/raw SHA、状态、阻断理由与非阻断观察,供RECORDED_FINAL_INPUT_GUARD下游汇总。
CONTENT_CLAIMS 模式(真人口播⑤)
输入是 episodes/<slug>/01-口播稿.md,输出固定为 04-事实核验.md 与 04-事实主张.json。报告开头必须含 script_hash: <当前稿 SHA-256>、fact_check_status: CLEAR|REVISE_REQUIRED|BLOCKED、contradicted_count 与 unverifiable_count frontmatter。claims JSON 必须含当前 script_hash、事实报告 SHA、每项外部主张的稳定 claim_id、原句、SUPPORTED|INFERRED|CONTRADICTED|UNVERIFIABLE|OPINION 结论及来源证据。只提取会影响观众判断、且能被外部证据验证的主张:机构行为、职位/产品定义、数字、增速、政策、研究结论、原话引用和时间关系。能由来源直接读出的才写 SUPPORTED;从实现、多个来源或行为推导出的结论写 INFERRED,并提供非空 inference_note。个人经验、价值判断、比喻与行动建议标为 OPINION。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 222 lines · 120 tokens per session scan A dec25b4bfe9f
laohan-shencha is a skill published in the GitHub repository hanzhcn/laohan-skills (11 stars, last pushed 14d ago), licensed MIT. It adds 120 tokens to every session and 4,852 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
videonote
A skill for turning video links or local videos from supported platforms into AI-generated Markdown notes. It can inspect videos, use available subtitles or transcription, and return notes with key points and chapters.
officecli-data-dashboard
Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics dashboard', 'executive dashboard', 'metrics dashboard', 'CSV to…
douyin-upload
A workflow for using the sau command-line tool to log in to Douyin, the Chinese short-video platform, check account cookies, and publish videos or image-and-text posts.
kuaishou-upload
A workflow for using the sau command-line tool to log in to Kuaishou, a Chinese social media platform, check account cookies, and publish videos or image-and-text posts.
xiaohongshu-upload
A workflow for using the sau command-line tool to log in to Xiaohongshu, a Chinese social media platform, check account cookies, and publish videos or image-and-text posts.
skill-authoring
Author SKILL.md skills: frontmatter, validator limits, structure.