Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MJorgin/dsh-media-skills --skill vision-reviewgit clone --depth 1 https://github.com/MJorgin/dsh-media-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mjorgin/dsh-media-skills/vision-review)<a href="https://agentmods.dev/skills/mjorgin/dsh-media-skills/vision-review"><img src="https://agentmods.dev/badge/skills/mjorgin/dsh-media-skills/vision-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mjorgin/dsh-media-skills/vision-review"><img src="https://agentmods.dev/badge/skills/mjorgin/dsh-media-skills/vision-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 3 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 27 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00150 | $0.01427 |
| Opus 5 | $0.00075 | $0.00714 |
| Sonnet 5 | $0.00030 | $0.00285 |
| Haiku 4.5 | $0.00015 | $0.00143 |
Grade A, and why
vision-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vision Review（读图 / 视觉检查）
免费读图，主引擎智谱 GLM-4V-Flash，可选 SiliconFlow Qwen3-VL、SenseNova（商汤日日新）、Google Gemini 备用。Key 永不写进本 skill。
用法
python3 scripts/vision.py <图片路径...> [--prompt="..."] [--provider=NAME] [--structured] [--doctor]
- 可一次传多张图；每张自动压成 JPEG 再发送，边长随批内张数自适应（1-2 张 1024px，3-4 张 768px，5 张 512px）。超过 5 张自动分批（GLM 单请求上限 5 张），自然语言模式按「【图片 X-Y】」标注批次，结构化模式输出
results数组。 - 每引擎输出预算：智谱 GLM-4V-Flash 为 1024（API 硬上限，超出报 1210）；SiliconFlow Qwen3-VL 与 Gemini 为 4096。结构化输出较大时，主引擎截断会自动回退到更大预算的引擎；prompt 请保持聚焦。
- 默认 prompt 检查渲染完整性、文字重叠/溢出/错位、配色层次、水印和视觉 bug。
- 指定具体任务时，用
--prompt="..."写清楚指令。 --structured：输出 modlens 同款结构化证据 JSON（summary / ocr.full_text / layout 阅读顺序区块 / semantics 实体与关系 / visual / uncertainty），供程序化消费。- 故障转移链：主引擎智谱 GLM-4V-Flash（免费）→ 配好
DEEPSEEK_API_KEY时自动加入 DeepSeek-V4-Flash-Vision-Exp（付费，走 DeepSeek 余额，质量更高；DEEPSEEK_VISION_MODEL可换模型；自动关思考并给 4096 输出预算）→ 配好SILICONFLOW_API_KEY时自动加入 SiliconFlow Qwen3-VL（SILICONFLOW_VISION_MODEL可换模型，默认Qwen/Qwen3-VL-8B-Instruct，国内直连）→ 配好SENSENOVA_API_KEY时自动加入 SenseNova → 配好GEMINI_API_KEY时自动加入 Google Gemini（GEMINI_MODEL可换模型，默认 gemini-3.6-flash）→VISION_FALLBACKS环境变量里配置的任意 OpenAI 兼容引擎（JSON 数组，每项name/baseUrl/apiKeyEnv/model，maxTokens/jsonObject可选）。每次回退都会打到 stderr，绝不无声失败。 --provider=NAME钉死单个引擎（zhipu-glm/siliconflow-qwen/gemini/自定义名），不回退；--doctor体检（Pillow、key、每个引擎一次近零成本的连通性实测），引擎异常时先跑它。
Key
GLM_API_KEY（智谱，免费视觉模型glm-4v-flash）。获取：注册/登录 open.bigmodel.cn → 「API Keys」→ 新建并复制（glm-4v-flash免费，无需付费）。DEEPSEEK_API_KEY（DeepSeek 官方，付费，可选）。和主 agent 同一个 key：harness v0.1.1+ 的凭据库（~/.dsh/.credentials.yaml）脚本会自动读取，无需额外配置；配好后自动加入回退链，且--provider=deepseek可钉死首选。SENSENOVA_API_KEY（商汤日日新，可选）。配好后自动加入回退链；默认模型sensenova-6.8-flash-lite，可用SENSENOVA_VISION_MODEL覆盖。GEMINI_API_KEY（Google，免费，可选）。获取：aistudio.google.com → 「Get API key」（约三分钟，无需信用卡）；配好后自动加入回退链。注意：Google 域名在本机网络可能不可直连，需要代理才可用——在同一个 secrets 文件里写GEMINI_PROXY=http://127.0.0.1:7897（换成你的代理地址）即可，只有 Gemini 引擎走代理，智谱等国内引擎保持直连。- 优先读环境变量；否则依次读
~/.dsh/secrets/media-tools.env、~/.codex/secrets/media-tools.env（每行KEY=value，权限 600）。 - 永远不要把 key 提交到仓库、写进 skill 或粘贴到公开文件。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 39 lines · 150 tokens per session scan A 28186f0a0fd5
vision-review is a skill published in the GitHub repository MJorgin/dsh-media-skills (19 stars, last pushed 11d ago), licensed MIT. It adds 150 tokens to every session and 1,427 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
figma-generate-design
Use this skill alongside figma-use when the task involves translating an application page, view, or multi-section layout into Figma. Triggers: 'write to Figma', 'create in Figma from code', 'push page to Figma', 'take this app/page and build it in Figma', 'create a screen', 'build a landing page in Figma', 'update the…
figma-use
MANDATORY prerequisite — you MUST invoke this skill BEFORE every usefigma tool call. NEVER call usefigma directly without loading this skill first. Skipping it causes common, hard-to-debug failures. Trigger whenever the user wants to perform a write action or a unique read action that requires JavaScript execution in…
figma-code-connect
Creates and maintains Figma Code Connect template files that map Figma components to code snippets. Use when the user mentions Code Connect, Figma component mapping, design-to-code translation, or asks to create/update .figma.ts or .figma.js files.
figma-generate-library
Build or update a professional-grade design system in Figma from a codebase. Use when the user wants to create variables/tokens, build component libraries, create individual components with proper variant sets and variable bindings, set up theming (light/dark modes), document foundations, or reconcile gaps between…
figma-implement-motion
Translates Figma motion and animations into production-ready application code. Use when implementing animation/motion from a Figma design — user mentions "implement this motion", "add animation from Figma", "animate this component", provides a Figma URL whose node is animated, or when getdesigncontext returns motion…