Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nexus-research-lab/nexus --skill caixun-work-hoursgit clone --depth 1 https://github.com/nexus-research-lab/nexusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nexus-research-lab/nexus/caixun-work-hours)<a href="https://agentmods.dev/skills/nexus-research-lab/nexus/caixun-work-hours"><img src="https://agentmods.dev/badge/skills/nexus-research-lab/nexus/caixun-work-hours/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nexus-research-lab/nexus/caixun-work-hours"><img src="https://agentmods.dev/badge/skills/nexus-research-lab/nexus/caixun-work-hours.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.02154 |
| Opus 5.5 | $0.00031 | $0.00862 |
| Sonnet 5.5 | $0.00015 | $0.00431 |
| Haiku 4.5 | $0.00008 | $0.00215 |
Grade B, and why
caixun-work-hours scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Codex:`~/.codex/config.toml` 的 `[mcp_servers.richpm]` 配置 url How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
彩讯工时填报
这是一个随 Nexus 发布、可直接从技能选择器启用的彩讯工时模板,来源于 SkillHub 的
@user_ab3d2b8a/richpm-daily-report(version 1.0.2)。首次使用只需接入一次
richpm MCP;没有接入时,按“首次接入”步骤配置,不会凭空提交工时。
你通过 MCP 服务器 richpm 的工具操作 RichPMS 工时系统(工具:get_report_calendar、get_fillable_projects_tasks、get_day_detail、check_can_submit、save_daily_report_draft、submit_daily_report)。
在 Nexus 中优先从左侧“连接器”或智能体“工具”页接入并完成授权;若当前版本没有该入口,
再提示用户按所用外部客户端接入 MCP 服务器 <后端地址>/api/ai/mcp:
- Claude Code:
claude mcp add richpm <后端地址>/api/ai/mcp --transport http - WorkBuddy:设置 → MCP 插件 → 添加 HTTP 服务器,地址同上(鉴权方式以客户端支持为准)
- Codex:
~/.codex/config.toml的[mcp_servers.richpm]配置 url 接入后按管理员指引完成授权(PMS 账号),工具名前缀以客户端实际注入为准(如 mcp__richpm__get_report_calendar)。
首次接入
用户说“配置 richpm / 接入日报”,或首次使用且工具不可用时:
- Nexus 内先引导用户到“连接器”或智能体“工具”页添加
richpm,填写管理员提供的服务地址并完成授权。 Skill 不自行修改 Nexus 配置、凭据或其他客户端的配置文件。 - 若用户明确选择外部客户端,再由用户主动运行
scripts/setup_mcp.py完成兼容配置;该脚本会修改外部客户端配置, 运行前应说明影响并确认目标客户端。 - 授权(均弹浏览器输 PMS 账密):WorkBuddy 跑
scripts/ai-workbuddy-auth.py、ZCode 跑scripts/richpm_zcode_auth.py;Claude Code 按客户端的 MCP/OAuth 登录流程完成授权;Codex(CLI) 运行codex mcp login richpm(自动动态注册后弹浏览器;桌面版对 http 内网授权服务器有安全限制, 需 HTTPS/SSH 隧道,详见对接指导)。 - 完成后提示重启外部客户端/开新会话,说“查我的日报”验证。
外部客户端兜底接入(Codex stdio bridge)
仅在用户明确选择 Codex 外部客户端且原生登录异常时,使用技能包内置的 stdio 桥接(Mac/Windows 通用)。 这条路径会由用户显式修改 Codex 配置,不是 Nexus 内置接入路径:
- 一次授权(浏览器输 PMS 账密,凭据缓存在
~/.codex/richpm/oauth.json自动刷新):- Mac/Linux:
python3 <技能包目录>/scripts/richpm_codex_mcp_client.py --login - Windows:
py <技能包目录>\scripts\richpm_codex_mcp_client.py --login
- Mac/Linux:
- config.toml 改 command 型 MCP(替换原 url 型 richpm 节点):
[mcp_servers.richpm] command = "python3" # Windows 用 "py" args = ["<技能包目录>/scripts/richpm_codex_mcp_client.py", "--stdio"] - 重启 Codex 生效;令牌过期自动刷新(401 自动重试一次),失效时重跑第 1 步。
令牌失效自愈(WorkBuddy 专属,2026-09-20)
调用 MCP 工具返回 401 / "令牌无效"时,在会话内按两级处理,用户无需离开 WorkBuddy:
- 免密续期(优先,先试这个):运行技能包内
scripts/ai-workbuddy-refresh.sh(GitBash:bash <技能包目录>/scripts/ai-workbuddy-refresh.sh,环境变量RICHPM_AI_BASE可覆盖后端地址, 默认从 mcp.json 的 richpm.url 自动推导)。 成功输出"令牌已续期并回写"→ 提示用户开新会话重试即可。 - 浏览器重新授权(refresh 失效时,退出码 2):运行
python <技能包目录>/scripts/ai-workbuddy-auth.py——会自动弹出系统浏览器到 RichPMS 授权页,请告诉用户"在弹出的页面输入 PMS 账号密码并确认"; 页面显示"RichPMS 授权成功"后脚本自动完成令牌回写。双击scripts/ai-workbuddy-auth.py同效(装有 Python 的机器)。 - 环境缺失(无 python / 无 GitBash)时如实告知用户,勿反复重试。
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- _meta.json 112 B
- references/validation-rules.md 1.5 KB
- scripts/ai-workbuddy-auth.py 7.2 KB runs code
- scripts/ai-workbuddy-login.sh 4.7 KB runs code
- scripts/ai-workbuddy-refresh.sh 3.5 KB runs code
- scripts/richpm_codex_mcp_client.py 21 KB runs code
- scripts/richpm_zcode_auth.py 5.3 KB runs code
- scripts/setup_mcp.py 7.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 100 lines · 77 tokens per session scan B b1f6e24793a7
caixun-work-hours is a skill published in the GitHub repository nexus-research-lab/nexus (160 stars, last pushed 2d ago), licensed Apache-2.0. It adds 77 tokens to every session and 2,154 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
caixun-work-hours compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| caixun-work-hoursnexus-research-lab/nexus | Skill | 160 | 2d ago | Apache-2.0 | B | 77 | Claude Code, Codex |
| Apple Notesagentic-in/elephant-agent | Skill | 586 | 2mo ago | none | A | 31 | Claude Code, Codex |
| GIF Searchagentic-in/elephant-agent | Skill | 586 | 2mo ago | none | A | 26 | Claude Code, Codex |
| agentscope-javaagentscope-ai/agentscope-java | Skill | 6.4k | today | Apache-2.0 | A | 91 | Claude Code, Codex |
| git-checkpointagentscope-ai/agentscope-java | Skill | 6.4k | today | Apache-2.0 | A | 39 | Claude Code, Codex |
| company-employeePrism-Shadow/penguin-harness | Skill | 3.2k | today | Apache-2.0 | A | 85 | Claude Code, Codex |
| penguin-pluginPrism-Shadow/penguin-harness | Skill | 3.2k | today | Apache-2.0 | A | 81 | Claude Code, Codex |