Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nongjun/feishu-cursor-claw --skill file-uploadgit clone --depth 1 https://github.com/nongjun/feishu-cursor-clawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nongjun/feishu-cursor-claw/file-upload)<a href="https://agentmods.dev/skills/nongjun/feishu-cursor-claw/file-upload"><img src="https://agentmods.dev/badge/skills/nongjun/feishu-cursor-claw/file-upload.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00438 |
| Opus 5 | $0.00017 | $0.00219 |
| Sonnet 5 | $0.00007 | $0.00088 |
| Haiku 4.5 | $0.00003 | $0.00044 |
Grade A, and why
file-upload scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
文件上传服务
关键方法（FileService）
| 方法 | 用途 |
|---|---|
| save_file(file, subdir, max_size) | 保存上传文件（自动重命名） |
| generate_thumbnail(file_path, max_size) | 生成缩略图（需 PIL） |
| delete_file(file_path) | 安全删除文件 |
| get_file_type(filename) | 根据 MIME 和扩展名判断类型 |
安全验证工具（upload_utils）
| 函数 | 用途 |
|---|---|
| validate_file_type(file) | Magic Number 验证（防伪造扩展名） |
| sanitize_filename(filename) | 文件名清理（防路径遍历） |
支持的文件类型
| 类型 | 扩展名 |
|---|---|
| 图片 | jpg, jpeg, png, gif, bmp, webp |
| 视频 | mp4, avi, mov, wmv, flv, mkv |
| 文档 | pdf, doc, docx, xls, xlsx, ppt |
SOP：集成文件上传
- 后端通过公共路由自动注册：create_common_router(upload_dir="/app/uploads")
- 上传端点：POST /api/{module}/common/upload
- 如需定制，直接实例化 FileService(upload_dir=...)
- 缩略图生成依赖 Pillow（可选安装）
重点关注
- 文件名自动生成：时间戳 + UUID，避免冲突
- 上传目录需在 Docker 中挂载卷持久化
- 部分模块（如内容中心）有独立 FileService 实现
参考文件
- 公共模块/shared_backend/services/file_service.py
- 公共模块/shared_backend/utils/upload_utils.py
- 公共模块/shared_backend/api/common.py（/upload 路由）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 50 lines · 34 tokens per session scan A 8fbc03fcb8b0
file-upload is a skill published in the GitHub repository nongjun/feishu-cursor-claw (14 stars, last pushed 1mo ago), licensed MIT. It adds 34 tokens to every session and 438 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
firebase-auth
Use when setting up auth, managing auth state, implementing email/password or social sign-in, handling auth errors, or managing users.
firebase-cloud-functions
Use when calling callable functions (httpsCallable), passing data to server-side logic, handling function errors/timeouts, configuring regions, or testing with the Emulator Suite.
firebase-data-connect
Use when setting up Data Connect, writing GraphQL queries/mutations, configuring generated SDKs, handling offline, or applying security rules.
create-handler
Create a new API handler following the handler pattern. Use when the user asks to create an endpoint, handler, or route.
developing-genkit-dart
Use when building AI agents in Dart, implementing Genkit flows or tools, integrating LLMs into Dart or Flutter applications, or using Genkit Dart plugins.
audit-backend-architecture
Read-only audit and decision advisor for backend architecture, topology-gated by stack. Use when "audit backend architecture", "which pattern should I use", "am I over-engineering", "sync vs event-driven". Mechanical boundary rules → enhance-arch-boundaries.