Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/midfang/ai-agent-skills-workflow/bug2csvnpx skills add midFang/ai-agent-skills-workflow --skill bug2csvgit clone --depth 1 https://github.com/midFang/ai-agent-skills-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/midfang/ai-agent-skills-workflow/bug2csv)<a href="https://agentmods.dev/skills/midfang/ai-agent-skills-workflow/bug2csv"><img src="https://agentmods.dev/badge/skills/midfang/ai-agent-skills-workflow/bug2csv.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.00933 |
| Opus 5 | $0.00041 | $0.00466 |
| Sonnet 5 | $0.00016 | $0.00187 |
| Haiku 4.5 | $0.00008 | $0.00093 |
Grade A, and why
bug2csv scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Bug2CSV
目的
把腾讯文档中的一个指定工作表 tab 导出为 .csv 文件,并使用用户 Chrome 里已有的登录状态。
这个 skill 只处理 CSV。腾讯文档的 .xlsx 导出通常会下载整个工作簿;图片 (.png) 导出可能触发会员图片生成弹窗,不作为本流程依赖。
输入
收集或推断:
- 腾讯文档表格链接,通常是
https://docs.qq.com/sheet/... - 目标 tab 名,例如
DemoApp(Android) - 可选输出位置;默认使用浏览器的 Downloads 目录
如果用户只给链接,先检查当前选中的 tab;只有目标 tab 不明确时才询问。
工作流程
- 使用 Chrome 控制能力,因为导出依赖用户已有的腾讯文档登录状态。
- 优先接管已经打开的腾讯文档 tab;如果没打开,再在 Chrome 中打开用户给的链接,并等待用户登录。
- 确认当前选中的工作表 tab。若不是用户要求的 tab,点击底部名称完全匹配的 tab,注意中文全角括号如
(安卓)。 - 打开腾讯文档的文件/菜单按钮。当前 UI 可能是右上角包含
下载 / 打印 / 在客户端打开的菜单,也可能是aria-label="file"的节点。 - 打开
导出为。 - 选择
本地CSV文件 (.csv, 当前工作表)。这是关键选项,只会导出当前活动 tab。 - 除非用户明确要求整个工作簿,否则不要选择
本地Excel表格 (.xlsx)。 - 点击 CSV 后,Chrome 不一定触发标准下载事件。必须检查
~/Downloads中最近的 CSV:
find "$HOME/Downloads" -maxdepth 1 -type f -iname '*.csv' -mmin -10 -print0 | xargs -0 ls -lt
- 选择最新且文件名/内容与文档标题和 tab 名匹配的 CSV。腾讯文档常见命名是
<文档标题>-<tab名>.csv。 - 报告前必须校验文件:
python3 - <<'PY'
from pathlib import Path
import csv
p = max(Path.home().joinpath("Downloads").glob("*.csv"), key=lambda x: x.stat().st_mtime)
raw = p.read_bytes()
for enc in ("utf-8-sig", "utf-8", "gb18030"):
try:
text = raw.decode(enc)
break
except UnicodeDecodeError:
pass
rows = list(csv.reader(text.splitlines()))
print(p)
print("encoding", enc)
print("rows", len(rows), "max_cols", max((len(r) for r in rows), default=0))
for row in rows[:5]:
print("\t".join(row[:10]))
PY
注意事项
- 页面可能只提示
请前往浏览器下载记录查看,仍然要用文件系统确认下载结果。 - 重复导出会产生
(1)这类后缀,优先选择最新且内容匹配的成功导出文件。 - CSV 不包含单元格内嵌图片/截图。如果后续需要图片证据,应单独通过浏览器截图或页面资源提取,不要指望 CSV 自带图片。
- 只使用页面可见操作和浏览器已有登录状态,不额外接触账号资料。
- 除非用户要求关闭,否则保留腾讯文档 tab。
完成回复
回复时说明:
- 导出的 CSV 本地路径,使用可点击文件链接
- 简短校验结果,例如行数、最大列数、编码
- 重要限制,尤其是“CSV 不包含内嵌图片”
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 79 lines · 82 tokens per session scan A 89e5bff6322a
bug2csv is a skill published in the GitHub repository midFang/ai-agent-skills-workflow (2 stars, last pushed 2mo ago), licensed MIT. It adds 82 tokens to every session and 933 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dcf-model
Build discounted cash flow valuation workbooks in Excel.
audit-xls
Audit a spreadsheet for formula accuracy, errors, and common mistakes. Scopes to a selected range, a single sheet, or the entire model (including financial-model integrity checks like BS balance, cash tie-out, and logic sanity). Triggers on "audit this sheet", "check my formulas", "find formula errors", "QA this…
google-drive-sheets
Find, read, export, edit, and manage the user's Google Drive, Docs, Sheets, and Slides through per-user OAuth.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
skill-doc-delivery
Convert markdown to DOCX, PPTX, XLSX, PDF office documents — use when you need exportable deliverables.
large-file-parquet-analysis-and-highlight
当Excel文件总行数超过1万行时,通过转换为Parquet格式提升读取性能,提取目标指标并计算最大值,最后将结果输出为Excel并对特定行进行高亮标注。.