Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add moonhorsemmy/shortcuts-toolkit --skill skillgit clone --depth 1 https://github.com/moonhorsemmy/shortcuts-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/moonhorsemmy/shortcuts-toolkit/skill)<a href="https://agentmods.dev/skills/moonhorsemmy/shortcuts-toolkit/skill"><img src="https://agentmods.dev/badge/skills/moonhorsemmy/shortcuts-toolkit/skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00152 | $0.01997 |
| Opus 5 | $0.00076 | $0.00999 |
| Sonnet 5 | $0.00030 | $0.00399 |
| Haiku 4.5 | $0.00015 | $0.00200 |
Grade A, and why
shortcuts-toolkit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Apple 快捷指令工具链 Skill
何时调用
当用户提到以下任何意图时，调用对应 CLI 子命令（而非手写 plist）：
| 意图 | 命令 |
|---|---|
| 读懂/分析 .shortcut | shortcuts-toolkit parse <file> |
| 看原始 plist 结构 | shortcuts-toolkit inspect <file> |
| 生成前预览（操作+模块+警告） | shortcuts-toolkit preview -i spec.json |
| ⭐ 系统校验（拦截「无法找到此操作」） | shortcuts-toolkit verify -i spec.json（或 preview --verify） |
| 按规格生成 unsigned | shortcuts-toolkit generate -i spec.json -o out.shortcut |
| 一键到正式成品（generate→sign→清理） | shortcuts-toolkit build -i spec.json -o out.signed.shortcut |
签名（macOS，可 --clean 删中间文件） |
shortcuts-toolkit sign <file> -o signed.shortcut --mode anyone --clean |
| 从 iCloud 分享链接下载 | shortcuts-toolkit icloud <url> |
| 生成调用链接（自动编码） | shortcuts-toolkit url -n <name> -i <输入> |
| 记账成品（固定 JSON→CSV） | shortcuts-toolkit bookkeeping -o out.shortcut |
| App Intent→POST 回传工具 | shortcuts-toolkit build-rr --bundle-id .. --intent-id .. --callback-url .. -o out.shortcut |
| 验证工具链 | shortcuts-toolkit self-test |
已安装则直接
shortcuts-toolkit ...；未安装则uvx shortcuts-toolkit ...。
⭐ 生成工作流（硬性流程，生成新快捷指令时必须按序，不得跳步）
- preview + verify 确认 —
shortcuts-toolkit preview --verify -i spec.json（macOS 用系统真实 identifier 复核），把「操作清单 + 模块汇总 + 警告」呈现给用户确认；或单独shortcuts-toolkit verify -i spec.json。重点确认：- ⚠️ 系统未注册的内置动作（
builtin_not_in_system，如generatemachinereadablecode/quicklook）→ reference 有错，导入后必报「无法找到此操作」，必须换成系统真实 identifier（见reference/ACTIONS.md顶部纠错表）。 - ⚠️ 第三方 App 动作（模块显示
App: <bundle>）→ 用户设备必须装了对应 App。 - ⚠️ 未知内置动作（不在 427 清单）→ 可能拼错/过时。
- ⚠️ 系统未注册的内置动作（
- 规范命名 — 名字必须 URL-safe（见下「命名规则」）。不合法 CLI 会报错并给建议，改到合法为止。
- 生成 — macOS 用
shortcuts-toolkit build -i spec.json -o out/<name>.signed.shortcut（一键 generate→sign→自动清理 unsigned 中间文件）；非 macOS 先generate，再传到 macOSsign --clean。 - 导入 — Finder 双击
.signed.shortcut，确认非空、无红字「无法找到此操作」。 - 调用 — 用
shortcuts-toolkit url -n <name> -i <输入>生成已编码的shortcuts://run-shortcut?name=...&input=...，禁止手拼 URL。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 97 lines · 152 tokens per session scan A 94feab383ec6
shortcuts-toolkit is a skill published in the GitHub repository moonhorsemmy/shortcuts-toolkit (4 stars, last pushed 1mo ago), licensed MIT. It adds 152 tokens to every session and 1,997 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
orbit-notion
Open Orbit briefing skill — selected by the Orbit pipeline when Notion is the user's only connected connector, or when the user explicitly scopes their daily digest to Notion. Pulls the past 24 hours of document edits, comments, mentions, and database row changes from the user's authenticated Notion connection and…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.