Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jyuwaaw/dianpo-skill --skill dianpogit clone --depth 1 https://github.com/jyuwaaw/dianpo-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo)<a href="https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo"><img src="https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jyuwaaw/dianpo-skill/dianpo"><img src="https://agentmods.dev/badge/skills/jyuwaaw/dianpo-skill/dianpo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00253 | $0.02088 |
| Opus 5.5 | $0.00101 | $0.00835 |
| Sonnet 5.5 | $0.00051 | $0.00418 |
| Haiku 4.5 | $0.00025 | $0.00209 |
Grade A, and why
dianpo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
点破 (Dianpo)
你在做的事
用户手里有一段能跑通的技术材料(endpoint、配置、协议、工作笔记),但缺一层心智模型:角色是谁、东西归谁、验证的方向是什么。资深工程师看一眼就能说出"这个 token 是 OpenAI 的",因为他脑子里装的不是代码,而是各方之间的信任拓扑。你的任务就是替用户补上这一层——找到那个用户最可能理解错、一说破全盘就通的事实,把它放在第一句。
不要写成教程或百科条目。用户已经会实现了,缺的只是"看透"。整个回答应该短——点破的价值恰恰在于短。
方法
按顺序问自己这五个问题(在脑子里做,不要把过程写给用户):
- 角色全列出来,包括隐身的那个。 代码里往往只出现一方;真正的关键角色经常不在代码里(比如来抓 well-known URL 的爬虫、签发 token 的 Portal、验证 JWT 的云厂商)。凡是"验证/challenge/回调"类机制,一定存在一个材料里没写的对端。
- 每个 artifact 过一遍四连问: 谁签发/生成?谁保管?谁消费/校验?什么时候失效?token、secret、key、URL、魔法字符串都算 artifact。"XXX 的 token"这种说法,指的是签发方,不是保管方——这是最常见的误读点。
- 定验证方向:谁在向谁证明什么。 一切 challenge/signature/handshake 的核心就这一句话。方向反了,整个模型就是错的(例:API key 是你向服务方证明身份;webhook 签名是服务方向你证明身份——同一对主体,方向相反)。
- 回答"为什么长这样":约束是什么。 设计的形状来自约束——不能共享 secret?对方无法主动连你?需要公开可抓取?先找约束,解释就自然成立。
- 挑出那一个点破点。 上面所有分析里,选用户最可能缺失或搞反的一个事实。它就是你的第一句话。
材料里看不出归属或角色时,去查(repo、官方文档、web search);查不到就明说不确定,并说明什么证据能确定——猜错归属比不点破更糟。
术语规则:缩写第一次出现时给全称加一句人话。 例:"OIDC(OpenID Connect,一套让 A 向 B 证明'我是谁'的开放标准)"、"STS(AWS 的临时凭证发放服务)"。原因:来问的人恰恰是缺这块心智模型的人,一个没解释的缩写会让整个点破失效。同理,别默认读者知道"传统做法"是什么——要对比传统方案时,先用一句话说清传统方案本身。
输出格式
用用户的语言回答。按这个结构,总长度控制在一屏左右:
1. 一句话点破(加粗,放最前)——点名角色、归属、方向。写成 Spencer 式的口吻:具体、有画面。
例:"这个 token 是 OpenAI 签发给你的'作业条'——你把它贴在自家域名的公开位置,OpenAI 的爬虫来读,读到了就证明这个域名归你管。"
2. 角色拆解——小表格,一行一个角色:
| 角色 | 拥有什么 | 做什么 |
|---|
3. 流程图——画出完整回路(签发 → 放置 → 抓取 → 判定),隐身角色必须出现在图里。原则:读者看到的必须是渲染好的图,不是图的源码。 出图前先看这个 session 手里有什么渲染工具,按下面的优先级选——能出真图就绝不退而求其次:
- 首选(默认走这条):有渲染工具就用它出真图。 只要 session 里能调到
show_widget(visualize)、Artifact、canvas 之类,就用它渲染一张真正的时序图(SVG/HTML):彩色方框、箭头、一个角色一列(隐身角色必须占一列),把整条回路画出来。工具在场就必须用——这是这个 skill 图部分的正常形态,不是加分项。别因为 ASCII 写起来省事就跳过它。 - 降级(仅当拿不到任何渲染工具):纯文本环境才用 ASCII。 只有在纯终端 CLI、或要把结果写进文件、确认无图可渲染时,才退回等宽 ASCII 时序图放进代码块,例如:
OpenAI Portal 你的 Worker OpenAI 验证器
│ ①签发 token │ │
│──────────────────>│(配置到环境变量) │
│ │ ②GET /.well-known/… │
│ │<──────────────────────│
│ │ ③返回 token │
│ │──────────────────────>│
│ │ ④比对 → 域名归属✓ │
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 75 lines · 253 tokens per session scan A 19980add5e57
dianpo is a skill published in the GitHub repository jyuwaaw/dianpo-skill (1 stars, last pushed 2mo ago), licensed MIT. It adds 253 tokens to every session and 2,088 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
canvas
Fetch Canvas LMS courses and assignments via API token.
model-architecture-rwkv
RNN+Transformer hybrid with O(n) inference. Linear time, infinite context, no KV cache. Train like GPT (parallel), infer like RNN (sequential). Linux Foundation AI project. Production at Windows, Office, NeMo. RWKV-7 (March 2025). Models up to 14B parameters.
build-interactive-explainers
A guide for building interactive explainers, calculators, and simulations driven by an executable model. Users change inputs, steps, states, or events to understand a rule or see how a process develops over time.
teach
Explain a body of work plainly so a person actually understands it. Runs the how and why skills and weaves what they find into one clear explanation. Use for 'teach me this', 'help me really understand X', 'explain this change or subsystem to me'.
skill-creation-walkthrough
Step-by-step guide for creating your own Claude Skills, from deciding whether a skill is the right tool to writing the SKILL.md file, structuring reference material, and making it trigger reliably. Use when you want to package a workflow, framework, or repeated task into a reusable Skill, when an existing skill is not…
memstack-marketing-webinar-script
Use this skill when the user says 'webinar script', 'webinar', 'live presentation', 'teach-to-sell', or needs a timestamped presentation script with slide notes, presenter cues, and replay email sequence. Do NOT use for launch plans or static sales page copy.