Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MJorgin/dsh-media-skills --skill vision-reviewgit clone --depth 1 https://github.com/MJorgin/dsh-media-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mjorgin/dsh-media-skills/vision-review)<a href="https://agentmods.dev/skills/mjorgin/dsh-media-skills/vision-review"><img src="https://agentmods.dev/badge/skills/mjorgin/dsh-media-skills/vision-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mjorgin/dsh-media-skills/vision-review"><img src="https://agentmods.dev/badge/skills/mjorgin/dsh-media-skills/vision-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 3 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 27 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.01355 |
| Opus 5.5 | $0.00048 | $0.00542 |
| Sonnet 5.5 | $0.00024 | $0.00271 |
| Haiku 4.5 | $0.00012 | $0.00136 |
Grade A, and why
vision-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vision Review(读图 / OCR / 视觉检查)
用于显式视觉审查工作流:截图 QA、图片内容描述、OCR、水印/Logo 检测、界面布局问题检查,以及给程序化流程输出结构化证据。
DSH 桌面端 0.2.0-rc.2 / v0.1.6+ 兼容性:原生图片附件要求当前会话模型的 inputModalities 包含 image;默认 deepseek-flash 支持图片。纯文本模型会拒绝附件(MODEL_DOES_NOT_SUPPORT_IMAGES),不会触发旧版“自动转写成文字再喂给当前模型”的管道。此时可切换到视觉模型路由,或把本地图片路径传给本技能脚本进行审查。上游最新 tag dsh-v0.2.1-alpha.2 的源码仍保留这套 provider/附件契约。本技能适合需要脚本、故障转移链或 JSON 证据时使用。
用法
从本技能目录运行:
python3 scripts/vision.py <图片路径...> [--prompt="..."] [--provider=NAME] [--structured] [--doctor]
常用示例:
python3 scripts/vision.py screenshot.png
python3 scripts/vision.py a.png b.png --structured
python3 scripts/vision.py page.png --provider=siliconflow-qwen
python3 scripts/vision.py page.png --prompt="检查标题、按钮和图表是否重叠,并指出位置"
python3 scripts/vision.py --doctor
行为
- 可一次传多张图;每张图会压缩成 JPEG,边长随批内张数自适应:1–2 张 1024px,3–4 张 768px,5 张 512px。
- GLM-4V-Flash 单请求最多 5 张图;超过 5 张自动分批。
- 默认 prompt 检查渲染完整性、文字重叠/溢出/错位、配色层次、水印和明显视觉 bug。
--structured输出结构化 JSON:summary、ocr.full_text、layout.regions、semantics、visual、uncertainty;多批时输出results数组。--provider=NAME固定单个引擎,不做故障转移。可用名包括zhipu-glm、deepseek、siliconflow-qwen、sensenova、gemini和自定义 fallback 名称。--doctor检查 Pillow、已配置 key、候选模型和端点连通性。遇到引擎异常时先运行它。
引擎链
脚本按以下顺序尝试;可选引擎只有检测到对应 key 时才加入:
- 智谱
glm-4v-flash(主引擎,GLM_API_KEY;输出上限 1024)。 - DeepSeek 视觉模型(
DEEPSEEK_API_KEY,付费可选;默认deepseek-v4-flash-vision-exp,可用DEEPSEEK_VISION_MODEL覆盖)。 - SiliconFlow Qwen3-VL(
SILICONFLOW_API_KEY;默认Qwen/Qwen3-VL-8B-Instruct,可用SILICONFLOW_VISION_MODEL覆盖)。 - SenseNova(
SENSENOVA_API_KEY;默认sensenova-6.8-flash-lite,可用SENSENOVA_VISION_MODEL覆盖)。 - Gemini OpenAI-compatible endpoint(
GEMINI_API_KEY;默认gemini-3.6-flash,可用GEMINI_MODEL覆盖)。 VISION_FALLBACKS中声明的任意 OpenAI 兼容多模态引擎。
VISION_FALLBACKS 是 JSON 数组,每项包含 name、baseUrl、model,可选 apiKeyEnv、maxTokens、jsonObject。
密钥来源
按顺序读取:
- 进程环境变量;
~/.dsh/secrets/media-tools.env;~/.codex/secrets/media-tools.env(历史兼容);~/.dsh/.credentials.yaml中的顶层 key 或refs子映射。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +2 lines 610b8b2bd3cc
- 1mo ago Changed · +36 lines · -31 tokens per session a65acbbe25e7
- 2mo ago First seen · 39 lines · 150 tokens per session scan A 28186f0a0fd5
vision-review is a skill published in the GitHub repository MJorgin/dsh-media-skills (25 stars, last pushed 3d ago), licensed MIT. It adds 119 tokens to every session and 1,355 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
steve-jobs-perspective
A product and leadership thinking framework based on Steve Jobs’s public talks, interviews, and biography. It emphasizes product focus, design choices, simplicity, and direct feedback.
figma-generate-design
Use this skill alongside figma-use when the task involves translating an application page, view, or multi-section layout into Figma. Triggers: 'write to Figma', 'create in Figma from code', 'push page to Figma', 'take this app/page and build it in Figma', 'create a screen', 'build a landing page in Figma', 'update the…
figma-use
MANDATORY prerequisite — you MUST invoke this skill BEFORE every usefigma tool call. NEVER call usefigma directly without loading this skill first. Skipping it causes common, hard-to-debug failures. Trigger whenever the user wants to perform a write action or a unique read action that requires JavaScript execution in…
figma-code-connect
Creates and maintains Figma Code Connect template files that map Figma components to code snippets. Use when the user mentions Code Connect, Figma component mapping, design-to-code translation, or asks to create/update .figma.ts or .figma.js files.
figma-generate-library
Build or update a professional-grade design system in Figma from a codebase. Use when the user wants to create variables/tokens, build component libraries, create individual components with proper variant sets and variable bindings, set up theming (light/dark modes), document foundations, or reconcile gaps between…
figma-implement-motion
Translates Figma motion and animations into production-ready application code. Use when implementing animation/motion from a Figma design — user mentions "implement this motion", "add animation from Figma", "animate this component", provides a Figma URL whose node is animated, or when getdesigncontext returns motion…