Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hanzhcn/laohan-skills --skill laohan-yunyinggit clone --depth 1 https://github.com/hanzhcn/laohan-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-yunying)<a href="https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-yunying"><img src="https://agentmods.dev/badge/skills/hanzhcn/laohan-skills/laohan-yunying/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hanzhcn/laohan-skills/laohan-yunying"><img src="https://agentmods.dev/badge/skills/hanzhcn/laohan-skills/laohan-yunying.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02397 |
| Opus 5 | $0.00037 | $0.01198 |
| Sonnet 5 | $0.00015 | $0.00479 |
| Haiku 4.5 | $0.00007 | $0.00240 |
Grade A, and why
laohan-yunying scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
抖音数据与评论编排器
本 skill 不发布、不准备发布文案、不代替 Jeffrey 点击平台。它只登记人工确认或本机Chrome适配器已经验证的发布事实,保存数据和评论证据;cheat-on-content 是预测与复盘引擎。
工作流
1. 发布事实登记
先运行 bianpai check --require final,再登记以下两种发布证据来源:
USER_CONFIRMED_MANUAL:当前唯一人工发布 source,沿用publish-record.json。Jeffrey 在平台手动发布后提供平台身份、URL(抖音还须aweme_id)与平台显示的精确标题platform_title。历史source: "user-confirmed"仅允许schema <4 episode只读兼容;迁移或新登记必须写USER_CONFIRMED_MANUAL。ADAPTER_VERIFIED_RECEIPT:读取12-发布/*-publish-results.jsonl中与当前final.mp4SHA匹配的最后一个PUBLISHED记录;自动回执的 canonical source 固定为 source: ADAPTER_VERIFIED_RECEIPT,缺失或为其他值都不得登记。
归一化登记记录必须保留platform、source、receipt_id|url、published_at、final_sha256和platform_title。ADAPTER_VERIFIED_RECEIPT读取每个平台完整JSONL后,从后向前选择首条同时匹配该平台、当前final SHA、publish_result: PUBLISHED且source精确为ADAPTER_VERIFIED_RECEIPT的合法回执;后续FAILED或其他final记录不得遮蔽它。回执还必须绑定authorized_by、authorized_at、authorization_note和bound_input_record_sha256,并与本期FULL_PIPELINE_TO_PUBLISH授权完全一致;published_at与recorded_at必须是有效时间且不得早于授权。缺少任何绑定字段就停,不能编造。
⑫只消费上述归一化登记;原始JSONL行、浏览器页面或“点击过”都不是完成证据。
本Skill不得承担发布点击、上传、表单填写或浏览器控制;这些只属于release package与本机Chrome适配器。自动发布回执只证明对应平台已发布,不证明该平台运营数据已经接通。
2. 人工发布记录
USER_CONFIRMED_MANUAL只登记 Jeffrey 提供的作品 URL、aweme_id 与 platform_title;不调用 URL 解析、平台浏览器、发布 adapter 或任何替代发布工具。URL 必须包含同一 aweme_id;缺任一身份字段则停,不能编造。ADAPTER_VERIFIED_RECEIPT只读取既有回执,不调用或驱动发布 adapter。
写 12-发布/publish-record.json:
{
"platform": "douyin",
"status": "PUBLISHED",
"url": "https://www.douyin.com/video/<aweme_id>",
"aweme_id": "<id>",
"platform_title": "平台显示的精确作品标题",
"published_at": "2026-07-10T20:00:00+08:00",
"final_path": "07-剪辑/final.mp4",
"final_sha256": "当前 final.mp4 的 SHA-256",
"source": "USER_CONFIRMED_MANUAL"
}
然后调用上游 cheat-publish 登记同一 URL;只更新预测 metadata,绝不修改预测段。完成后运行 node scripts/register-cheat-publish-evidence.mjs episodes/<slug>,保存 publish 时点的 lane state 快照并验证 prediction header、URL、aweme_id、发布时间和不可变预测段;缺该证据时⑫不得完成。
发布后首屏截图或创作者中心导出是可选强证据,不能代替 Jeffrey 的发布事实,也不因缺失阻断⑫。若保存,证据文件必须在本期 12-发布/,并写 platform-display-evidence.json:schema_version: 1、evidence_path/SHA、aweme_id、platform_title、display_title、cover_asset/SHA、final_sha256、title/cover/video 三项 MATCHED 结论、reviewer、captured_at、reviewed_at。任一项与当前 publish-record、selected-cover 或 final 不一致时,⑫必须显示未完成,直到删去该可选证据或重做核对;不得自动修正或伪造截图。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 91 lines · 75 tokens per session scan A 8476133e7a4e
laohan-yunying is a skill published in the GitHub repository hanzhcn/laohan-skills (11 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 2,397 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
officecli-word-form
Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…
officecli-data-dashboard
Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics dashboard', 'executive dashboard', 'metrics dashboard', 'CSV to…
douyin-upload
A workflow for using the sau command-line tool to log in to Douyin, the Chinese short-video platform, check account cookies, and publish videos or image-and-text posts.
kuaishou-upload
A workflow for using the sau command-line tool to log in to Kuaishou, a Chinese social media platform, check account cookies, and publish videos or image-and-text posts.
xiaohongshu-upload
A workflow for using the sau command-line tool to log in to Xiaohongshu, a Chinese social media platform, check account cookies, and publish videos or image-and-text posts.
skill-authoring
Author SKILL.md skills: frontmatter, validator limits, structure.