Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Komagon/hermes-production-patternsnpx agentmods add skills/komagon/hermes-production-patterns/daily-news-digestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/komagon/hermes-production-patterns/daily-news-digest)<a href="https://agentmods.dev/skills/komagon/hermes-production-patterns/daily-news-digest"><img src="https://agentmods.dev/badge/skills/komagon/hermes-production-patterns/daily-news-digest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/komagon/hermes-production-patterns/daily-news-digest"><img src="https://agentmods.dev/badge/skills/komagon/hermes-production-patterns/daily-news-digest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00676 |
| Opus 5 | $0.00017 | $0.00338 |
| Sonnet 5 | $0.00007 | $0.00135 |
| Haiku 4.5 | $0.00003 | $0.00068 |
Grade A, and why
daily-news-digest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Daily News Digest
实时演示 conventions/ 中全部四条工程公约的完整集成：
- state-file-pattern — STATE.md 跨运行状态
- control-flow-separation — 抓取用代码 / 摘要用 LLM
- maker-checker — Checker 五维验证摘要质量
- error-compact-pattern — 错误不炸上下文
工作流
Step 1: 读取状态（确定性）✅
从 STATE.md 读取上次运行状态和 idempotency keys。
Step 2: 抓取 RSS（确定性）✅
# 零 LLM 成本。只处理上次运行后新增的文章。
import feedparser
for url in RSS_SOURCES:
feed = feedparser.parse(url)
new = [entry for entry in feed.entries
if entry.id not in state.get("idempotency_keys", [])]
Step 3: LLM 摘要（概率性）❌
# 每日限 5 篇，控制 token 开销。
for article in new[:5]:
summary = await llm.complete(
f"按三点总结，每条不超过20字：\n标题：{article.title}\n{article.description}"
)
Step 4: Checker 验证（概率性）❌
独立 Agent 对摘要做五维评分，≥ 40/50 PASS。
Step 5: 更新状态（确定性）✅
state["progress"]["articles_summarized"] += len(passed)
state["idempotency_keys"].extend([a.id for a in processed])
atomic_write("STATE.md", state) # 原子写入 + 文件锁
错误处理
# 按 error-compact-pattern 压缩错误
try:
feed = feedparser.parse(url)
except Exception as e:
compact = f"[STEP_FAILED] fetch_rss@{now}\n Error: {type(e).__name__} - {str(e)[:80]}\n Recoverable: YES (retry with backoff)"
context.append(compact)
输出格式
# 新闻摘要 {YYYY-MM-DD}
## 📰 {article.title}
- {point 1}
- {point 2}
- {point 3}
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +1 lines 86ae13d17969
- 12d ago First seen · 86 lines · 35 tokens per session scan A cc76607ece66
daily-news-digest is a skill published in the GitHub repository Komagon/hermes-production-patterns (16 stars, last pushed 4d ago), licensed MIT. It adds 35 tokens to every session and 676 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
thisWeek
Resolve "thisWeek" to a concrete ISO date range relative to your run time — this week so far (Monday → today). Returns inclusive civil dates plus exact UTC instants so you have temporal context without computing dates by hand. Read-only: no writes, no network. Use before a week-to-date task (this week's activity…
comet-design
A workflow guide for turning an existing software change into a detailed technical design document. It builds on earlier proposal and design files and defines implementation risks, tests, and edge cases.
comet-verify
Comet Phase 4: Verify and Close. Invoke with /comet-verify. Verify implementation matches design, handle development branch.
generate-harness-dsl
Generate, revise, or review complete Harness as Code .harness files when a coding-agent workflow, agent role, skill, tool contract, MCP connection, runtime, or deployment must be compiler-valid and resolvable with @qoder-ai/harness.
hunt-auth-bypass
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024)…
m365-entra-attack
Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced…