Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add konglong87/superPM --skill super-pm-upgradegit clone --depth 1 https://github.com/konglong87/superPMWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/konglong87/superpm/super-pm-upgrade)<a href="https://agentmods.dev/skills/konglong87/superpm/super-pm-upgrade"><img src="https://agentmods.dev/badge/skills/konglong87/superpm/super-pm-upgrade/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/konglong87/superpm/super-pm-upgrade"><img src="https://agentmods.dev/badge/skills/konglong87/superpm/super-pm-upgrade.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.02033 |
| Opus 5 | $0.00023 | $0.01017 |
| Sonnet 5 | $0.00009 | $0.00407 |
| Haiku 4.5 | $0.00005 | $0.00203 |
Grade A, and why
super-pm-upgrade scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 334 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Preamble (run first)
bash "$(dirname "${BASH_SOURCE[0]}")/../check-update.sh" 2>/dev/null || true
# 检测当前版本
if [ -f "VERSION" ]; then
CURRENT_VERSION=$(cat VERSION)
echo "📦 当前版本: $CURRENT_VERSION"
else
echo "⚠️ 未找到VERSION文件"
CURRENT_VERSION="unknown"
fi
# 检测Git仓库
if [ -d ".git" ]; then
echo "✅ Git仓库检测成功"
else
echo "❌ 未检测到Git仓库,无法升级"
exit 1
fi
跨 Agent 交互规则
当流程要求与用户交互时:
- 如果当前环境支持 AskUserQuestion,使用 AskUserQuestion(最佳体验)。
- 如果当前环境不支持 AskUserQuestion,必须用普通聊天消息提出同样问题。
- 一次只问一个问题。
- 提问后必须停止当前回合,等待用户回答(STOP and WAIT)。
- 不得在用户回答前生成文档、写入 docs。
- 已有 docs 文件不能替代本轮用户回答。
执行流程
步骤 1: 检测当前版本
使用 Read 工具读取 VERSION 文件。
记录当前版本到变量 CURRENT_VERSION
步骤 2: 查询最新版本
使用 Bash 工具执行:
# 获取远程仓库最新版本标签
git fetch --tags
# 获取最新标签
LATEST_TAG=$(git tag --sort=-v:refname | head -n 1)
echo "🏷️ 最新版本: $LATEST_TAG"
记录最新版本到变量 LATEST_VERSION
步骤 3: 对比版本
AI 对比 CURRENT_VERSION 和 LATEST_VERSION:
如果当前版本 = 最新版本:
✅ 您已在最新版本!
当前版本: {CURRENT_VERSION} 最新版本: {LATEST_VERSION}
无需升级。
结束流程。
如果当前版本 < 最新版本:
🎉 发现新版本!
当前版本: {CURRENT_VERSION} 最新版本: {LATEST_VERSION}
是否查看更新日志?
用户选择后,继续。
步骤 4: 查看更新日志
使用 Bash 工具:
# 查看最新版本的更新日志
git log --pretty=format:"- %s" $CURRENT_VERSION..$LATEST_TAG
显示更新内容:
📋 更新日志 ({LATEST_VERSION}):
{更新内容}
询问用户:
是否升级到 {LATEST_VERSION}?
A) 是的,立即升级(推荐) B) 查看完整变更日志后再决定 C) 暂不升级
步骤 5: 执行升级
如果用户选择升级:
5.1 备份当前版本
使用 Bash 工具:
# 创建备份分支
BACKUP_BRANCH="backup/$(date +%Y%m%d_%H%M%S)"
git checkout -b $BACKUP_BRANCH
echo "✅ 已创建备份分支: $BACKUP_BRANCH"
5.2 切换到最新版本
# 切换到最新标签
git checkout $LATEST_TAG
# 验证VERSION文件
NEW_VERSION=$(cat VERSION)
echo "✅ 已切换到版本: $NEW_VERSION"
5.3 验证升级
使用 Read 工具验证 VERSION 文件内容。
确认版本号已更新。
步骤 6: 输出完成提示
✅ 升级成功!
原版本: {CURRENT_VERSION} 新版本: {LATEST_VERSION}
备份分支: {BACKUP_BRANCH}
如需回退,执行:
git checkout {BACKUP_BRANCH}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 334 lines · 47 tokens per session scan A 2ce5597d4aba
super-pm-upgrade is a skill published in the GitHub repository konglong87/superPM (64 stars, last pushed 5d ago), licensed MIT. It adds 47 tokens to every session and 2,033 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
multi-search
A web-search helper that chooses among DuckDuckGo, Tavily, Bing API, and Bing scraping based on the available network.
freeride
Manages free AI models from OpenRouter for OpenClaw. Automatically ranks models by quality, configures fallbacks for rate-limit handling, and updates openclaw.json. Use when the user mentions free AI, OpenRouter, model switching, rate limits, or wants to reduce AI costs.
deepsafe-scan
Preflight security scanner for AI coding agents — scans deployment config, skills/MCP servers, memory/sessions, and AI agent config files (hooks injection) for secrets, PII, prompt injection, and dangerous patterns. Runs 4 model behavior probes (persuasion, sandbagging, deception, hallucination). Supports LLM-enhanced…
mapick
Mapick — Skill recommendation & privacy protection for OpenClaw. Scans your local skills, suggests what you're missing, and keeps other skills from seeing your sensitive data.
douyin-upload-mcp-skill
A guide for publishing videos and image-and-text posts through Douyin's creator website. Douyin is a Chinese social-media platform, and the guide uses its creator platform and available MCP tools.
team-tasks
Coordinate multi-agent development pipelines using shared JSON task files. Use when dispatching work across dev team agents (code-agent, test-agent, docs-agent, monitor-bot), tracking pipeline progress, or running sequential/parallel workflows. Covers project init, task assignment, status tracking, agent dispatch via…