Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/meltforce/vimmary/verifynpx skills add meltforce/vimmary --skill verifygit clone --depth 1 https://github.com/meltforce/vimmaryWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00102 | $0.01069 |
| Opus 5 | $0.00051 | $0.00535 |
| Sonnet 5 | $0.00020 | $0.00214 |
| Haiku 4.5 | $0.00010 | $0.00107 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verify
The chain CI runs, in the order that fails fastest. Run it from the repo root before committing.
1. The embed stub comes first
web.go carries //go:embed all:web/dist, and .gitignore excludes that
directory. Every Go command below fails with an embed error on a fresh
checkout until web/dist exists — this is not a broken build, it is a missing
directory.
Either build the frontend for real (step 5, needed anyway if you touched web/),
or create the stub CI uses:
mkdir -p web/dist && touch web/dist/.gitkeep
2. Build, format and vet
CGO_ENABLED=0 go build -o /tmp/vimmary ./cmd/vimmary
gofmt -l internal/ cmd/
go vet ./...
CGO_ENABLED=0 matches the Docker image, which is built without a C toolchain.
A build that only passes with cgo enabled will fail in CI.
gofmt -l prints the files that are not formatted and nothing else — empty
output is the pass. Nothing else in this chain checks it: golangci-lint's
default set has no formatting linter, and CI runs neither. An unformatted file
was committed on 2026-08-07 (9afc86a, a misaligned struct tag in
internal/models/models.go) and no step objected.
The two files that predated this step — internal/mcp/server.go (import order)
and internal/storage/videos_integration_test.go — were formatted on
2026-08-07. gofmt -l now prints nothing on a clean tree, so any output is
from the change in front of you.
3. Tests
go test -race ./...
The storage tests need a database and do not skip locally.
internal/storage/videos_integration_test.go connects to
postgres://vimmary:vimmary@localhost:5434/vimmary, which is what
docker compose up db exposes — note the port is 5434, not 5432. Start it
first:
docker compose up -d db
Override with TEST_DATABASE_URL if the database lives elsewhere. The test skips
only when CI is set, which means CI does not cover the storage layer — a
regression there is caught locally or not at all.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 107 lines · 102 tokens per session scan A 8b755554f26a
verify is a skill published in the GitHub repository meltforce/vimmary (5 stars, last pushed 4d ago), licensed MIT. It adds 102 tokens to every session and 1,069 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
douyin-upload
当 agent 需要通过已安装的 sau CLI 完成抖音登录、cookie 校验、视频上传或图文发布时使用这个 skill。该 skill 适用于已经安装 social-auto-upload 且可调用 sau 命令的环境。优先使用这个 skill 进行稳定的命令式抖音工作流，而不是一开始就阅读 uploader 源码。.
kuaishou-upload
当 agent 需要通过已安装的 sau CLI 完成快手登录、cookie 校验、视频上传或图文发布时使用这个 skill。该 skill 适用于已经安装 social-auto-upload 且可调用 sau 命令的环境。优先使用这个 skill 进行稳定的命令式快手工作流，而不是一开始就阅读 uploader 源码。.
xiaohongshu-upload
当 agent 需要通过已安装的 sau CLI 完成小红书登录、cookie 校验、视频上传或图文发布时使用这个 skill。该 skill 适用于已经安装 social-auto-upload 且可调用 sau 命令的环境。优先使用这个 skill 进行稳定的命令式小红书工作流，而不是一开始就阅读 uploader 源码。.
release
Prepare, validate, and publish a Pake release. Not for version bumps without release intent.
pake
Package any website or local web build into a lightweight desktop app using Pake (Tauri/Rust). Use when the user wants to: wrap a URL as a native app, build a desktop app from a website or a local dist/ folder, use Pake CLI to package a page, set up proxy for a packaged app, customize app icons or bundle IDs, or…
github-ops
GitHub issue, PR, and release operations via gh CLI. Not for code review or release builds.