Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kangarooking/system-prompt-skills --skill citation-systemgit clone --depth 1 https://github.com/kangarooking/system-prompt-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kangarooking/system-prompt-skills/citation-system)<a href="https://agentmods.dev/skills/kangarooking/system-prompt-skills/citation-system"><img src="https://agentmods.dev/badge/skills/kangarooking/system-prompt-skills/citation-system/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kangarooking/system-prompt-skills/citation-system"><img src="https://agentmods.dev/badge/skills/kangarooking/system-prompt-skills/citation-system.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.01617 |
| Opus 5 | $0.00051 | $0.00809 |
| Sonnet 5 | $0.00020 | $0.00323 |
| Haiku 4.5 | $0.00010 | $0.00162 |
Grade A, and why
citation-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
引用与归属系统设计
R — 原文 (Reading)
各厂商采用多样化的内联引用格式:Claude Web 使用 Markdown 锚点链接(
[text](<citation:comment:{id}>)),GPT-4o 文件搜索采用【msg_idx:search_idx†source】,NotebookLM 实现逐句引用加段落索引[i],Warp 使用 XML 结构<citations><document>,Meta AI 实现实体标签【entity_hint-...】。核心模式:内联标记、引用保留规则、来源可审计响应。
I — 方法论骨架 (Interpretation)
- 内联标记格式:在生成文本中直接嵌入来源标记,用户无需滚动至文末即可定位引用源。
- 格式一致性:整个系统提示中严格使用一种引用格式,不混用多种标记语法。
- 引用保留规则:在改写、总结、翻译等二次处理中,原始引用标记必须完整保留,不得丢失或篡改。
- 来源可审计性:每个事实性声明都必须有可追溯的引用,外部信息(非系统知识库)必须显式标注。
- 实体引用系统:除文档引用外,可扩展支持人物、地点、组织等实体的标记与链接。
- 日期消歧:对相对时间表达("昨天"、"上周")进行绝对日期解析,消除歧义。
A1 — 案例分析 (Past Application)
案例: GPT-4o 文件搜索的强制引用机制
- 问题: 用户上传多份文档后提问,模型可能编造不存在于文档中的内容,或混淆内容来源。
- 设计模式的使用: GPT-4o 要求所有基于文档的回答必须包含
【msg_idx:search_idx†source】格式引用。引用不是可选装饰,而是强制性输出组成部分。未找到引用时不得声称信息来源于文档。 - 结论: 将引用从"建议行为"升级为"强制约束",显著降低了文档问答中的幻觉率。
案例: Warp 的 XML 结构化引用
- 问题: 终端命令辅助场景中,用户需要精确知道命令参数的文档来源,但传统脚注格式在终端中可读性差。
- 设计模式的使用: Warp 采用 XML 结构
<citations><document>元素,将引用与工具名隔离——引用指向文档本身而非工具调用过程,避免暴露内部实现。 - 结论: 引用系统的设计应适配输出媒介特性,且引用目标应指向信息源而非系统内部过程。
A2 — 触发场景 (Future Trigger) ★
用户在什么情境下需要?
- 构建文档问答系统,需要让用户验证每个答案的来源
- 设计搜索增强生成(RAG)系统提示,需要强制引用检索结果
- 开发代码辅助工具,需要将建议关联到代码库中的具体位置
- 实现多源信息整合系统,需要区分不同来源的贡献
语言信号
- "需要标注信息来源"
- "用户应该能追溯每个结论的出处"
- "如何防止模型编造引用"
- "引用格式应该怎么设计"
- "需要保留原始引用标记"
与相邻 skill 的区分
- 与 injection-defense 区别:注入防御关注内容是否可信/可执行,引用系统关注内容来自哪里、如何标注
- 与 mobile-adaptation 区别:移动适配关注引用在狭小屏幕上的展示优化,引用系统关注引用的格式与保留规则
E — 可执行步骤 (Execution)
- 步骤 1:定义引用标记语法 - 完成标准:选择一种内联标记格式(方括号标注如
【source†Lline】、Markdown 锚点、或 XML 元素),明确定义每个字段含义(消息索引、搜索索引、行号范围),并编写格式示例。 - 步骤 2:编写强制引用规则 - 完成标准:在系统提示中声明"所有基于外部来源的事实性声明必须附带引用",定义无引用时的回退行为(明确声明无法确认来源),禁止编造不存在的引用。
- 步骤 3:设计引用保留策略 - 完成标准:规定在改写、总结、翻译等二次处理场景中,原始引用标记的保留方式——直接保留原文标记、或重新映射到新上下文位置,确保引用链不中断。
- 步骤 4:实现外部信息标记 - 完成标准:定义"外部信息"(非系统知识库中的信息)的显式标记方式,如 NotebookLM 要求外部信息必须标注"此信息不在提供的来源中"。
- 步骤 5:添加引用完整性校验 - 完成标准:在系统提示中设置自检规则——输出前验证所有引用标记格式正确、所有事实性声明均有引用、引用中的索引和行号在有效范围内。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 75 lines · 101 tokens per session scan A e16d64da872b
citation-system is a skill published in the GitHub repository kangarooking/system-prompt-skills (184 stars, last pushed 4mo ago), licensed MIT. It adds 101 tokens to every session and 1,617 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ai-engineering-toolkit
6 production-ready AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.
AI & LLM Security
LLM and AI application security testing — prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG and agent/tool-use security, model supply chain, and AI red teaming for authorized assessments.
dspy
Build complex AI systems with declarative programming, optimize prompts automatically, create modular RAG systems and agents with DSPy - Stanford NLP's framework for systematic LM programming.
AI System Quality Engineer
Test LLM, RAG, MCP, and agentic systems end to end. Build golden datasets, run deterministic checks and LLM judges, score retrieval, probe prompt injection, verify tool use, and gate CI on thresholds. Orchestrates DeepEval, Ragas, promptfoo, and Langfuse.
llm-prompt-injection
Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures.
ai-engineering-toolkit
AI Engineering Toolkit workflow skill. Use this skill when the user needs 6 production-ready AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching and the operator…