dianpo

dianpo is a skill for Claude Code, Codex from jyuwaaw/dianpo-skill. It costs 253 tokens per session (2,088 once invoked), scanned A, original, MIT.

A Chinese-language guide for explaining the hidden roles and trust relationships in technical systems. It clarifies who owns tokens, keys, certificates, and endpoints, who checks them, and what each party proves.

In plain words
What is it for?
Use it to explain configuration files, endpoints, authentication flows, challenges, signatures, callbacks, and the ownership or verification direction of credentials.
Why use it?
It addresses the misunderstandings that often make authentication and protocol configurations confusing, especially when the other party is not visible in the code.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to explain configuration files, endpoints, authentication flows, challenges, signatures, callbacks, and the ownership or verification direction of credentials.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/jyuwaaw/dianpo-skill/dianpo
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add jyuwaaw/dianpo-skill --skill dianpo
Clone the repo
git clone --depth 1 https://github.com/jyuwaaw/dianpo-skill

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dianpo

README.md
[![agentmods](https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo/github.svg)](https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo)
Your own site
<a href="https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo"><img src="https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dianpo

Your own site · 80×15
<a href="https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo"><img src="https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 253 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,088 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00253 $0.02088
Opus 5 $0.00127 $0.01044
Sonnet 5 $0.00051 $0.00418
Haiku 4.5 $0.00025 $0.00209

Measured 11d ago against content hash 19980add5e57, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

dianpo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/dianpo/SKILL.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

点破 (Dianpo)

你在做的事

用户手里有一段能跑通的技术材料(endpoint、配置、协议、工作笔记),但缺一层心智模型:角色是谁、东西归谁、验证的方向是什么。资深工程师看一眼就能说出"这个 token 是 OpenAI 的",因为他脑子里装的不是代码,而是各方之间的信任拓扑。你的任务就是替用户补上这一层——找到那个用户最可能理解错、一说破全盘就通的事实,把它放在第一句。

不要写成教程或百科条目。用户已经会实现了,缺的只是"看透"。整个回答应该短——点破的价值恰恰在于短。

方法

按顺序问自己这五个问题(在脑子里做,不要把过程写给用户):

  1. 角色全列出来,包括隐身的那个。 代码里往往只出现一方;真正的关键角色经常不在代码里(比如来抓 well-known URL 的爬虫、签发 token 的 Portal、验证 JWT 的云厂商)。凡是"验证/challenge/回调"类机制,一定存在一个材料里没写的对端。
  2. 每个 artifact 过一遍四连问: 谁签发/生成?谁保管?谁消费/校验?什么时候失效?token、secret、key、URL、魔法字符串都算 artifact。"XXX 的 token"这种说法,指的是签发方,不是保管方——这是最常见的误读点。
  3. 定验证方向:谁在向谁证明什么。 一切 challenge/signature/handshake 的核心就这一句话。方向反了,整个模型就是错的(例:API key 是你向服务方证明身份;webhook 签名是服务方向你证明身份——同一对主体,方向相反)。
  4. 回答"为什么长这样":约束是什么。 设计的形状来自约束——不能共享 secret?对方无法主动连你?需要公开可抓取?先找约束,解释就自然成立。
  5. 挑出那一个点破点。 上面所有分析里,选用户最可能缺失或搞反的一个事实。它就是你的第一句话。

材料里看不出归属或角色时,去查(repo、官方文档、web search);查不到就明说不确定,并说明什么证据能确定——猜错归属比不点破更糟。

术语规则:缩写第一次出现时给全称加一句人话。 例:"OIDC(OpenID Connect,一套让 A 向 B 证明'我是谁'的开放标准)"、"STS(AWS 的临时凭证发放服务)"。原因:来问的人恰恰是缺这块心智模型的人,一个没解释的缩写会让整个点破失效。同理,别默认读者知道"传统做法"是什么——要对比传统方案时,先用一句话说清传统方案本身。

输出格式

用用户的语言回答。按这个结构,总长度控制在一屏左右:

1. 一句话点破(加粗,放最前)——点名角色、归属、方向。写成 Spencer 式的口吻:具体、有画面。

例:"这个 token 是 OpenAI 签发给你的'作业条'——你把它贴在自家域名的公开位置,OpenAI 的爬虫来读,读到了就证明这个域名归你管。"

2. 角色拆解——小表格,一行一个角色:

角色 拥有什么 做什么

3. 流程图——画出完整回路(签发 → 放置 → 抓取 → 判定),隐身角色必须出现在图里。原则:读者看到的必须是渲染好的图,不是图的源码。 出图前先看这个 session 手里有什么渲染工具,按下面的优先级选——能出真图就绝不退而求其次:

  • 首选(默认走这条):有渲染工具就用它出真图。 只要 session 里能调到 show_widget(visualize)、Artifact、canvas 之类,就用它渲染一张真正的时序图(SVG/HTML):彩色方框、箭头、一个角色一列(隐身角色必须占一列),把整条回路画出来。工具在场就必须用——这是这个 skill 图部分的正常形态,不是加分项。别因为 ASCII 写起来省事就跳过它。
  • 降级(仅当拿不到任何渲染工具):纯文本环境才用 ASCII。 只有在纯终端 CLI、或要把结果写进文件、确认无图可渲染时,才退回等宽 ASCII 时序图放进代码块,例如:
OpenAI Portal          你的 Worker           OpenAI 验证器
     │  ①签发 token        │                      │
     │──────────────────>│(配置到环境变量)        │
     │                    │   ②GET /.well-known/… │
     │                    │<──────────────────────│
     │                    │   ③返回 token          │
     │                    │──────────────────────>│
     │                    │      ④比对 → 域名归属✓ │

Read the full file on GitHub · 75 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 75 lines · 253 tokens per session scan A 19980add5e57

Subscribe to this mod's changes

dianpo is a skill published in the GitHub repository jyuwaaw/dianpo-skill (1 stars, last pushed 26d ago), licensed MIT. It adds 253 tokens to every session and 2,088 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

canvas

Fetch Canvas LMS courses and assignments via API token.

NousResearch/hermes-agent · 12 tokens

rwkv-architecture

RNN+Transformer hybrid with O(n) inference. Linear time, infinite context, no KV cache. Train like GPT (parallel), infer like RNN (sequential). Linux Foundation AI project. Production at Windows, Office, NeMo. RWKV-7 (March 2025). Models up to 14B parameters.

davila7/claude-code-templates · 72 tokens

skill-creation-walkthrough

Step-by-step guide for creating your own Claude Skills, from deciding whether a skill is the right tool to writing the SKILL.md file, structuring reference material, and making it trigger reliably. Use when you want to package a workflow, framework, or repeated task into a reusable Skill, when an existing skill is not…

rampstackco/claude-skills · 135 tokens

stride-analysis-patterns

Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.

sangrokjung/claude-forge · 30 tokens

prompts-chat

Use when searching, installing, or improving AI skills and prompts via prompts.chat or skills.sh. Triggers on skill search, prompt lookup, install skill, improve prompt, prompts.chat.

sangrokjung/claude-forge · 41 tokens

bq-skill

A coaching workflow for building a reusable library of truthful stories for behavioral job interviews. It uses structures such as STAR—Situation, Task, Action, Result—and can connect stories to a job description and résumé.

yanliudesign/offer-toolkit-skill · 166 tokens