Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jyuwaaw/dianpo-skill --skill dianpogit clone --depth 1 https://github.com/jyuwaaw/dianpo-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo)<a href="https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo"><img src="https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo"><img src="https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00253 | $0.02088 |
| Opus 5 | $0.00127 | $0.01044 |
| Sonnet 5 | $0.00051 | $0.00418 |
| Haiku 4.5 | $0.00025 | $0.00209 |
Grade A, and why
dianpo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
点破 (Dianpo)
你在做的事
用户手里有一段能跑通的技术材料(endpoint、配置、协议、工作笔记),但缺一层心智模型:角色是谁、东西归谁、验证的方向是什么。资深工程师看一眼就能说出"这个 token 是 OpenAI 的",因为他脑子里装的不是代码,而是各方之间的信任拓扑。你的任务就是替用户补上这一层——找到那个用户最可能理解错、一说破全盘就通的事实,把它放在第一句。
不要写成教程或百科条目。用户已经会实现了,缺的只是"看透"。整个回答应该短——点破的价值恰恰在于短。
方法
按顺序问自己这五个问题(在脑子里做,不要把过程写给用户):
- 角色全列出来,包括隐身的那个。 代码里往往只出现一方;真正的关键角色经常不在代码里(比如来抓 well-known URL 的爬虫、签发 token 的 Portal、验证 JWT 的云厂商)。凡是"验证/challenge/回调"类机制,一定存在一个材料里没写的对端。
- 每个 artifact 过一遍四连问: 谁签发/生成?谁保管?谁消费/校验?什么时候失效?token、secret、key、URL、魔法字符串都算 artifact。"XXX 的 token"这种说法,指的是签发方,不是保管方——这是最常见的误读点。
- 定验证方向:谁在向谁证明什么。 一切 challenge/signature/handshake 的核心就这一句话。方向反了,整个模型就是错的(例:API key 是你向服务方证明身份;webhook 签名是服务方向你证明身份——同一对主体,方向相反)。
- 回答"为什么长这样":约束是什么。 设计的形状来自约束——不能共享 secret?对方无法主动连你?需要公开可抓取?先找约束,解释就自然成立。
- 挑出那一个点破点。 上面所有分析里,选用户最可能缺失或搞反的一个事实。它就是你的第一句话。
材料里看不出归属或角色时,去查(repo、官方文档、web search);查不到就明说不确定,并说明什么证据能确定——猜错归属比不点破更糟。
术语规则:缩写第一次出现时给全称加一句人话。 例:"OIDC(OpenID Connect,一套让 A 向 B 证明'我是谁'的开放标准)"、"STS(AWS 的临时凭证发放服务)"。原因:来问的人恰恰是缺这块心智模型的人,一个没解释的缩写会让整个点破失效。同理,别默认读者知道"传统做法"是什么——要对比传统方案时,先用一句话说清传统方案本身。
输出格式
用用户的语言回答。按这个结构,总长度控制在一屏左右:
1. 一句话点破(加粗,放最前)——点名角色、归属、方向。写成 Spencer 式的口吻:具体、有画面。
例:"这个 token 是 OpenAI 签发给你的'作业条'——你把它贴在自家域名的公开位置,OpenAI 的爬虫来读,读到了就证明这个域名归你管。"
2. 角色拆解——小表格,一行一个角色:
| 角色 | 拥有什么 | 做什么 |
|---|
3. 流程图——画出完整回路(签发 → 放置 → 抓取 → 判定),隐身角色必须出现在图里。原则:读者看到的必须是渲染好的图,不是图的源码。 出图前先看这个 session 手里有什么渲染工具,按下面的优先级选——能出真图就绝不退而求其次:
- 首选(默认走这条):有渲染工具就用它出真图。 只要 session 里能调到
show_widget(visualize)、Artifact、canvas 之类,就用它渲染一张真正的时序图(SVG/HTML):彩色方框、箭头、一个角色一列(隐身角色必须占一列),把整条回路画出来。工具在场就必须用——这是这个 skill 图部分的正常形态,不是加分项。别因为 ASCII 写起来省事就跳过它。 - 降级(仅当拿不到任何渲染工具):纯文本环境才用 ASCII。 只有在纯终端 CLI、或要把结果写进文件、确认无图可渲染时,才退回等宽 ASCII 时序图放进代码块,例如:
OpenAI Portal 你的 Worker OpenAI 验证器
│ ①签发 token │ │
│──────────────────>│(配置到环境变量) │
│ │ ②GET /.well-known/… │
│ │<──────────────────────│
│ │ ③返回 token │
│ │──────────────────────>│
│ │ ④比对 → 域名归属✓ │
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 75 lines · 253 tokens per session scan A 19980add5e57
dianpo is a skill published in the GitHub repository jyuwaaw/dianpo-skill (1 stars, last pushed 26d ago), licensed MIT. It adds 253 tokens to every session and 2,088 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
canvas
Fetch Canvas LMS courses and assignments via API token.
rwkv-architecture
RNN+Transformer hybrid with O(n) inference. Linear time, infinite context, no KV cache. Train like GPT (parallel), infer like RNN (sequential). Linux Foundation AI project. Production at Windows, Office, NeMo. RWKV-7 (March 2025). Models up to 14B parameters.
skill-creation-walkthrough
Step-by-step guide for creating your own Claude Skills, from deciding whether a skill is the right tool to writing the SKILL.md file, structuring reference material, and making it trigger reliably. Use when you want to package a workflow, framework, or repeated task into a reusable Skill, when an existing skill is not…
stride-analysis-patterns
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
prompts-chat
Use when searching, installing, or improving AI skills and prompts via prompts.chat or skills.sh. Triggers on skill search, prompt lookup, install skill, improve prompt, prompts.chat.
bq-skill
A coaching workflow for building a reusable library of truthful stories for behavioral job interviews. It uses structures such as STAR—Situation, Task, Action, Result—and can connect stories to a job description and résumé.