Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kihara777/NixKits --skill nixkits-package-upstreamgit clone --depth 1 https://github.com/Kihara777/NixKitsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kihara777/nixkits/nixkits-package-upstream)<a href="https://agentmods.dev/skills/kihara777/nixkits/nixkits-package-upstream"><img src="https://agentmods.dev/badge/skills/kihara777/nixkits/nixkits-package-upstream/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kihara777/nixkits/nixkits-package-upstream"><img src="https://agentmods.dev/badge/skills/kihara777/nixkits/nixkits-package-upstream.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00142 | $0.02543 |
| Opus 5.5 | $0.00057 | $0.01017 |
| Sonnet 5.5 | $0.00028 | $0.00509 |
| Haiku 4.5 | $0.00014 | $0.00254 |
Grade A, and why
nixkits-package-upstream scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NixKits 上游贡献适配层
本技能是 nixpkgs-package-upstream 的仓库适配层。
通用方法（评估六问、by-name 与 nixpkgs-vet 要求、dry-run 四层判据、AI 政策、陷阱清单）
在那边；这里只写 NixKits 特有的东西。
开工前先读通用技能。顺序不能换：评估 → 审计 → dry-run → 实操。
第 0 步：本仓的两条硬约定
① flake.lock 不提交，本地操作前先 rm -f flake.lock。
（理由见 AGENTS.md：llama-cpp-ver 是浮动输入。）
② 开工前先 git fetch origin 对齐远端。
并行会话可能已经动过同一批文件。
第 1 步：可行性台账（2026-10-10 取证）
不要重新从零评估——先读这份台账与 UPSTREAM-AUDIT.md，
再只更新变化的部分。 取证基线是 nixpkgs master 78f093ad1（2026-10-10T03:06Z）。
| 包 | 在 nixpkgs 里 | 结论 |
|---|---|---|
| blender-mcp | 没有 | 推荐，许可已查实、测试已打通 |
| obs-bilibili-stream | 没有 | 可做，先改用 nixpkgs 的 OBS 插件构建助手 |
| opencode-telegram | 没有 | 可做，先摘掉 riscv64 那段 |
| ruyi | 没有 | 需评估，426 行补丁要先静态化 |
| kitsfmt | 没有 | 暂缓，上游仓 404 |
| codewhale | 没有 | 不推荐（主发行是预编译二进制） |
| godot-ai | 没有 | 不推荐（钉死 14 个精确运行时版本） |
| dsh | 没有 | 停止（nixpkgs 里叫 deepseek-harness，已有 3 个在途 PR） |
| mcp-searxng | 已在 | 不提交新包 |
三条最容易踩的：
mcp-searxng已经在 nixpkgs 里，initial PR #557725 于 2026-09-03 合并， 且有人开着 2.5.1 的更新 PR。列进「新包清单」是错的。dsh在 nixpkgs 里叫deepseek-harness——按我们的包名搜是搜不到的。 三个在途 PR：#552467 / #553134 / #554081，都是 8 月开的，至今未合并。 我们这份从 npm 制品打、还要sed改包内文件，不是 nixpkgs 要的形态。kitsfmt的meta.homepage指向本仓，而github.com/Kihara777/kitsfmt返回 404。 先给它建独立仓库与 tag。
台账要更新时：把新的取证基线与日期写进 UPSTREAM-AUDIT.md，
不要在技能里堆历史。技能记方法，审计文档记那一时刻的事实。
第 2 步：本仓特有的前置处置
2.1 过期自述：先更正，再引用
本仓的文档与注释里有过后来被证实是错的断言。已发现的一处：
packages/ruyi/ruyi.nix 的注释写着「nixpkgs 已不再提供 ruyi 包」——
取证结论相反：nixpkgs 里从未有过 ruyi（by-name 的 ru/ 分片没有、
commit 搜索 0、issue/PR 搜索 0、Discourse 搜索 0）。
真实来源八成是本仓自己的 build-ruyi-*.yml。
规矩：任何「上游已经……」「nixpkgs 已不再……」的句子，引用前先取证。 发现是错的就当次改掉并单独提交，不要留着让下一个人再错一次。
2.2 许可依据：先找源文件与清单，再考虑向上游要
blender-mcp 取的是 v1.0.3，而那个 tag 里没有 LICENSE 文件；
GPL-3.0 的 LICENSE 是十八天后才加进 main 的。
但许可并不缺 —— 它写在每个源文件里：
我们构建出来的产物带 # SPDX-License-Identifier: GPL-3.0-or-later，
add-on 的 blender_manifest.toml 也声明了。
而且上游 issue
#59
就是问这件事的，维护者的答复原话是「licence is in the individual files」。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 166 lines · 142 tokens per session scan A 8843475ff594
nixkits-package-upstream is a skill published in the GitHub repository Kihara777/NixKits (28 stars, last pushed yesterday), licensed MIT. It adds 142 tokens to every session and 2,543 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.
Other skills, from other repositories
git-commit
A guided Git commit workflow that examines changes and creates a commit message using the Conventional Commits format, a shared style for labeling changes such as features, fixes, tests, or documentation.
git-master
Advanced Git operations — rebase, squash, fixup, blame, bisect, reflog, code archaeology (git log -S/-G), worktrees. Use when the task mentions rebase, squash, bisect, blame, reflog, fixup, finding deleted code, tracing commit history, cleaning up a branch, or recovering lost work.
to-tickets
A workflow for turning a written plan or specification into separate GitHub issues, with each issue covering one independently finishable piece of work.
git-expert
Expert-level Git version control with advanced workflows, branching strategies, and best practices for team collaboration. Use when the user mentions version control, collaboration, or workflow, or when the task involves Essential Git Commands, Advanced Git Techniques, Branching Strategies, or Conflict Resolution.
commit-message
Guidance for writing Git commit messages using Conventional Commits, a common format such as fix, feat, or docs followed by a short description. It focuses on explaining why a change was made.
gh-cli
Standardize all GitHub work via gh CLI (repos, issues, PRs, reviews, Actions, labels, releases). Trigger on any GitHub URL (incl. deep links like /pull/123, /issues/123.