Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mowenxd/cli/mo-notenpx skills add mowenxd/cli --skill mo-notegit clone --depth 1 https://github.com/mowenxd/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00065 | $0.13017 |
| Opus 5 | $0.00032 | $0.06509 |
| Sonnet 5 | $0.00013 | $0.02603 |
| Haiku 4.5 | $0.00006 | $0.01302 |
Grade A, and why
mo-note scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 662 lines — stays where its author put it; the contents beside it link to each section on GitHub.
前置约束
CRITICAL — 先阅读 共享规则,其中包含 mocli 初始化、认证、输出解析以及安全规则
mocli note - 墨问笔记
命令选择规则
- 用户要“创建/发布/写一篇墨问笔记”时,使用
mocli note create。这是写入操作,执行前必须确认用户确实要创建笔记,尤其是带--publish自动发布时。 - 用户要“编辑/修改/更新已有墨问笔记正文”时,使用
mocli note edit。这是写入操作,执行前必须确认目标笔记 ID、完整替换后的正文来源、已完成覆盖风险强制门禁,以及用户确实要覆盖原笔记正文。 - 用户要“设置/修改笔记隐私/公开或私有某篇笔记/设置部分公开规则”时,使用
mocli note set。这是写入操作,执行前必须确认目标笔记 ID 和隐私设置;当前note set只支持隐私设置,不用于修改正文、标签或发布内容。 - 用户要“查看某篇笔记当前有哪些标签”时,使用
mocli note tag --note-id <note-id>。这是读取操作,不会修改笔记标签。 - 用户要“设置/追加/移除/覆盖某篇笔记的标签”时,使用
mocli note tag。这是写入操作,执行前必须确认目标笔记 ID 和标签操作;--reset是覆盖全量标签,会忽略同次命令里的--append和--remove。 - 用户要“查看某篇笔记详情/笔记信息/引用笔记/评论”且已经有笔记 ID 时,使用
mocli note info --show-comment --show-refer。这是读取操作;只有在编辑笔记前需要获取当前 NoteAtom 时才额外添加--show-atom,其它场景避免使用--show-atom。 - 用户要“搜索某关键词相关笔记”时,使用
mocli notes search。 - 用户要“看某人的主页/公开笔记/热门笔记/付费笔记/合集”时,使用
mocli notes homepage。 - 用户要“看我自己的笔记/私有笔记/未公开笔记/我写过的笔记”时,使用
mocli notes mine。 - 用户要“看某个/某些标签下的笔记、按标签筛选我的笔记”时,使用
mocli notes tagged;只支持当前认证用户自己的标签,标签名称或 ID 不明确时,先用mo-tag的mocli tag mine获取候选。 - 用户提到人名、昵称、备注名但没有给 UID 时,优先用
mo-remark查 UID;未命中再考虑mocli user search或询问用户补充 UID。 - 创建/编辑笔记正文时,如果需要把本地文件或远端 URL 转成墨问文件 ID,先使用
mo-misc的mocli misc upload获取reply.file_id。 - 展示笔记列表时,优先按
reply.note_ids的顺序遍历,再到reply.notes[note_id]获取笔记详情,并用reply.notes[note_id].uid到reply.users获取作者信息。
正文资源引用处理流程
创建和编辑笔记时,如果源内容里包含图片、音频或 PDF 资源引用,应先确认用户希望“上传到墨问并引用 file_id”,还是“保留原始 URL/路径文本”。不要在未确认时自动上传用户文件或远端 URL。
需要触发确认的场景
- HTML 中出现
<img src="...">时,且src明确指向图片文件或可判断为图片资源。 - HTML 中出现
<a href="...">时,且href明确指向图片、音频或 PDF 文件。 - Markdown 中出现本地文件引用时,例如
、[报告](./report.pdf)、[音频](../audio.wav),且文件格式为图片、音频或 PDF。
上传与转换规则
- 用户选择上传时,按
mo-misc使用mocli misc upload获取上传结果。本地文件使用--file,远端 URL 使用--url;可用原始文件名、alt 文本或链接文本作为--filename。 - 上传结果至少读取
reply.file_id;如果存在,也读取reply.file_type、reply.file_name、reply.file_mime、reply.file_size、reply.file_meta。file_meta是 JSON 字符串,可能包含音频duration、图片width/height、PDFformat等元信息;解析失败时不要阻断正文转换,只跳过对应增强属性。 - 上传成功后,将资源转换为正文语法树资源节点:图片使用
{ "type": "image", "attrs": { "uuid": "<file_id>", "alt": "<可选描述>" } };音频使用{ "type": "audio", "attrs": { "audio-uuid": "<file_id>" } };PDF 使用{ "type": "pdf", "attrs": { "uuid": "<file_id>" } }。 - 生成音频节点时,尽量从
reply.file_meta.duration读取音频时长;如果存在,写入attrs.audio-duration,属性值使用字符串形式,例如{ "type": "audio", "attrs": { "audio-uuid": "<file_id>", "audio-duration": "236.878367" } }。 - 生成 PDF 节点时,尽量补充展示信息:
attrs.name优先使用reply.file_name,attrs.size优先使用reply.file_size的字符串形式;如果file_meta中有更明确的 PDF 元信息,可作为辅助参考,但不要覆盖用户明确指定的文件名。 - 用户选择保留原始 URL 时,不要生成资源节点;将 URL 作为普通链接文本保留在段落中,例如
text.marks里的linkmark。对于本地路径,提醒用户本地路径在墨问正文中通常无法被其他人访问;用户仍要求保留时,再按普通文本或链接文本保留。 - 如果 HTML/Markdown 资源类型无法明确判断为图片、音频或 PDF,默认保留为普通链接,不调用上传。
- 如果同一正文中有多个资源,先列出资源清单并一次性询问用户哪些需要上传、哪些保留原始 URL/路径;获得决定后再执行上传和正文树转换。
- 如果用户选择了较多的文件进行上传,提醒用户文件上传是有配额的,“默认配额 20 次/天,Pro 会员用户 200 次/天”,避免超出限制。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 662 lines · 65 tokens per session scan A 7524fbfd7966
mo-note is a skill published in the GitHub repository mowenxd/cli (33 stars, last pushed 7d ago), licensed MIT. It adds 65 tokens to every session and 13,017 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…