Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lovstudio/skills --skill media-fetchgit clone --depth 1 https://github.com/lovstudio/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lovstudio/skills/media-fetch)<a href="https://agentmods.dev/skills/lovstudio/skills/media-fetch"><img src="https://agentmods.dev/badge/skills/lovstudio/skills/media-fetch.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 87 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 88 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 89 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 90 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Excessive Agency · line 118 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02574 |
| Opus 5 | $0.00032 | $0.01287 |
| Sonnet 5 | $0.00013 | $0.00515 |
| Haiku 4.5 | $0.00006 | $0.00257 |
Grade A, and why
lov-media-fetch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
影视寻宝 · Media Finder
Turn one natural-language request into a verified local media file. Search broadly, identify the actual cut, balance picture quality against size, check storage before transfer, race viable sources, monitor the winner, recover from stalls, and inspect the completed file.
Triggers
Activate when
- 用户说“帮我找并下载这部电影”“下载导演剪辑版，画质好一点但别太大”“找带中英字幕的完整版”。
- 用户给出片名、年份、版本偏好，或已有 Magnet/Torrent，希望自动完成选择、下载和验收。
- The user asks to find and download the best release, fetch an extended cut, or download a compact high-quality copy with Chinese and English subtitles.
Do not activate when
- 用户只想了解影片资料、比较不同剪辑或获得观看建议，不要求取得本地文件。
- 用户只要下载普通网页文件、软件安装包、网页视频片段或直播流。
- 用户明确要求发布、上传、转码压制或制作字幕；这些是下载完成后的独立任务。
Product contract
- One request should normally run end to end without repeated confirmation.
- Prefer an edition whose identity is supported by runtime, release metadata, or file-level evidence. A filename alone is weak evidence.
- “Best” means the highest useful viewing quality inside the user's size and disk budget, not the largest file or highest advertised resolution.
- Default to embedded Simplified Chinese plus English subtitles. Treat filename claims as hints until streams or synchronized external subtitles are inspected.
- Ask the user only when title identity is ambiguous, editions contain materially different content, or the top candidates are close enough that taste decides.
- Never begin payload transfer before the destination capacity check passes.
- Keep observing an active job. A task added to a client is not a completed result.
- Completion means that the final local payload exists and the verification report is written. A client-reported 100% is only an intermediate signal.
- Keep advertised seeders, observed peers, metadata readiness, received bytes, and sustained speed as separate evidence fields. A large seeder count is not a speed promise.
- Use aria2 as the default transfer backend for direct URLs, Metalinks, Magnets, and Torrent inputs. Enable qBittorrent only when its search plugins, queue UI, swarm inspection, or long-term seeding materially helps the task. Record every backend choice and switch; do not create a second full payload by accident.
- A missing
zh-Hansstream is a recoverable subtitle gap, not a reason to mislabel the media. The subtitle branch may consultlov-subtitle-freedom-skillfor timestamp-preserving UTF-8 SRT handling. Its English-learning gloss and ASS modes stay opt-in; plain Chinese subtitle delivery remains a separate, clearly named SRT.
What ships with it
33 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 84 B
- AGENTS.md 1.0 KB
- assets/example-candidates.json 2.8 KB
- assets/example-qbit-results.json 708 B
- cases/cases.json 1.6 KB
- cases/evidence/lotr-download.json 1.3 KB
- cases/evidence/lotr-verification.json 1.2 KB
- CHANGELOG.md 1.4 KB
- kit.yaml 874 B
- LICENSE 1.0 KB
- pricing-card.yaml 648 B
- README.md 4.8 KB
- references/acquisition-policy.md 4.0 KB
- references/candidate-schema.md 3.5 KB
- references/quality-policy.md 3.3 KB
- references/subtitle-handoff.md 1.5 KB
- references/user-config.md 3.1 KB
- scripts/aria2_acquire.py 19 KB runs code
- scripts/media_config.py 6.8 KB runs code
- scripts/qbittorrent_acquire.py 18 KB runs code
- scripts/qbittorrent_search.py 7.5 KB runs code
- scripts/rank_candidates.py 9.9 KB runs code
- scripts/storage_preflight.py 4.4 KB runs code
- scripts/test_aria2_acquire.py 3.2 KB runs code
- scripts/validate_skill.py 17 KB runs code
- scripts/verify_media.py 7.9 KB runs code
- skill-card.md 4.2 KB
- skill-card.yaml 6.2 KB
- skill.yaml 749 B
- skills/media-acquisition/SKILL.md 5.2 KB
- skills/media-discovery/SKILL.md 4.2 KB
- skills/media-selection/SKILL.md 4.0 KB
- skills/media-verification/SKILL.md 3.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 80474ec34f64
- 8d ago First seen · 219 lines · 65 tokens per session scan A d3e1a0f929dc
lov-media-fetch is a skill published in the GitHub repository lovstudio/skills (64 stars, last pushed today), licensed MIT. It adds 65 tokens to every session and 2,574 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
polar-billing
This skill should be used when working on Polar billing system, Stripe integration, subscription lifecycle, checkout flows, or benefit provisioning.
dokploy-deploy
This skill should be used when user asks to "deploy with Dokploy", "use Dokploy Cloud", "manage self-hosted Dokploy", "deploy Docker Compose on Dokploy", "manage Dokploy databases", "configure Dokploy domains", or "look up Dokploy CLI commands".
mongodb-connection
Optimize MongoDB client connection configuration (pools, timeouts, patterns) for any supported driver language. Use this skill when working/updating/reviewing on functions that instantiate or configure a MongoDB client (eg, when calling connect()), configuring connection pools, troubleshooting connection errors…
mongodb-schema-design
MongoDB schema design patterns and anti-patterns. Use when designing data models, reviewing schemas, migrating from SQL, or troubleshooting performance issues caused by schema problems. Triggers on "design schema", "embed vs reference", "MongoDB data model", "schema review", "unbounded arrays", "one-to-many", "tree…
mongodb-search-and-ai
Guides MongoDB users through implementing and optimizing Atlas Search (full-text), Vector Search (semantic), and Hybrid Search solutions. Use this skill when users need to build search functionality for text-based queries (autocomplete, fuzzy matching, faceted search), semantic similarity (embeddings, RAG…
update-pr-summary
This skill should be used when user asks to "update PR summary", "update PR description", "rewrite PR body", "refresh PR title and body", or explicitly invokes "update-pr-summary".