Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hxy91819/mason-skills --skill droid-configgit clone --depth 1 https://github.com/hxy91819/mason-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hxy91819/mason-skills/droid-config)<a href="https://agentmods.dev/skills/hxy91819/mason-skills/droid-config"><img src="https://agentmods.dev/badge/skills/hxy91819/mason-skills/droid-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hxy91819/mason-skills/droid-config"><img src="https://agentmods.dev/badge/skills/hxy91819/mason-skills/droid-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.01682 |
| Opus 5 | $0.00017 | $0.00841 |
| Sonnet 5 | $0.00007 | $0.00336 |
| Haiku 4.5 | $0.00003 | $0.00168 |
Grade A, and why
droid-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Droid 配置
只在用户显式调用 $droid-config 后执行。本 Skill 覆盖 Droid CLI 升级、BYOK/自定义模型、默认模型、上下文压缩和 Mission 角色路由。
开始前
-
完整阅读 官方来源与刷新规则,在线核对本次涉及的 Droid 与模型资料。
-
涉及模型、上下文、输出上限、effort 或 Mission 时,再阅读 配置经验。其中的数值是带日期的经验快照,不是当前事实源。
-
先运行只读检查:
python3 scripts/droid_config_audit.py check python3 scripts/droid_config_audit.py show -
确认
command -v droid、droid --version、droid update --check、droid --help和droid exec --help。从实际命令输出确认安装方式、更新入口、模型 ID 与可用 effort。
安全边界
- 先读后写;只修改用户要求的 Droid 配置。保留无关设置与并发改动。
- 把
~/.factory/settings.json视为密钥文件。仅输出脱敏投影;不得打印完整文件、apiKey、token、Authorization header 或可逆的全文编码。 - 写入前创建带时间戳的备份并设为
0600。完成后把活动配置也设为0600。 - 复用已有凭据时在进程内复制值,不经过 stdout、命令回显或补丁正文。缺少目标供应商凭据时停止并请用户提供安全的凭据来源。
- 升级、配置写入和最小模型调用属于用户明确请求时才执行的副作用。除非用户明确要求运行 Mission,不启动完整 Mission;模型配置验证只做最小调用。
- 官方资料不可达、来源相互冲突或供应商上限无法验证时,保留现值并报告不确定性。
工作流
1. 建立来源矩阵
对每个目标模型记录并交叉核验:展示名、请求模型 ID、API 协议与 base URL、上下文窗口、供应商实际最大输出、支持的 reasoning effort、图像能力和资料日期。
采用以下优先级:实际供应商端点与错误响应 > 当前供应商文档 > 模型厂商文档 > 本 Skill 的经验快照。Droid 字段语义和 Mission 字段以当前 Factory 文档与 droid --help 为准。发生差异时保留两层事实并解释最终取值。
2. 升级 Droid
先 droid update --check,再在用户要求升级时运行 droid update。升级后重新运行版本、帮助和模型目录检查;新版本可能改变模型 ID、effort 枚举或配置 schema。
3. 设计并写入配置
customModels只保留用户指定的自定义模型;不要把“清理自定义模型”扩大为组织级内置模型禁用。maxOutputTokens使用当前供应商路由实际接受的上限,不直接照抄模型厂商理论上限。noImageSupport根据实际路由能力设置;该字段只表达配置意图,不证明 Droid 会实际转发图片。供应商/api/show或等价模型信息优先于营销页。compactionTokenLimitPerModel必须为最长一次输出和额外安全余量留空间,取便于审计的向下取整值。- 自定义 ID 稳定、唯一;Mission、默认会话与压缩映射全部引用最终 ID。清除已删除模型的悬空映射。
- sampling 参数只有在官方明确要求且供应商允许时才加入
extraArgs;供应商固定的参数保持省略。
4. 配置 Mission
使用当前 Factory 文档中的字段:
missionOrchestratorModel/missionOrchestratorReasoningEffortmissionModelSettings.workerModel/workerReasoningEffortmissionModelSettings.validationWorkerModel/validationWorkerReasoningEffort
编排器与验证器优先质量,worker 兼顾吞吐;所有 effort 都必须先验证目标模型支持。保留 skipScrutiny、skipUserTesting 等用户未要求变更的策略,并在交付时说明其有效状态。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +2 lines ea425920da27
- 8d ago First seen · 100 lines · 34 tokens per session scan A d5f95313bf02
droid-config is a skill published in the GitHub repository hxy91819/mason-skills (2 stars, last pushed today), licensed MIT. It adds 34 tokens to every session and 1,682 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…