Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add oneworks-ai/app --skill update-entitygit clone --depth 1 https://github.com/oneworks-ai/appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/oneworks-ai/app/update-entity)<a href="https://agentmods.dev/skills/oneworks-ai/app/update-entity"><img src="https://agentmods.dev/badge/skills/oneworks-ai/app/update-entity/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/oneworks-ai/app/update-entity"><img src="https://agentmods.dev/badge/skills/oneworks-ai/app/update-entity.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 68 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01498 |
| Opus 5.5 | $0.00013 | $0.00599 |
| Sonnet 5.5 | $0.00007 | $0.00300 |
| Haiku 4.5 | $0.00003 | $0.00150 |
Grade A, and why
update-entity scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
在用户要求“更新实体”“调整 entity/agent”“给某个实体加规则/技能/记忆”“把实体改成继承另一个实体”“重命名或拆分已有实体”时使用这个 skill。
如果用户要求创建全新的实体,使用 create-entity。
目标
先读懂已有实体的职责和资产关系,再按用户需求做最小、可验证的更新。不要把更新任务当成重写任务;默认保留用户已有内容、命名、文件布局和引用关系。
更新前检查
先确认目标实体:
- 不要硬编码
.oo。先定位本地资产根目录和实体目录。 - 默认实体目录是
.oo/entities/;如果.env设置了__ONEWORKS_PROJECT_BASE_DIR__或__ONEWORKS_PROJECT_ENTITIES_DIR__,按实际资产根目录和实体目录查找。 - 在本地实体目录查找同名实体,包含
<name>.md、<name>/README.md和<name>/index.json。 - 如果文件名和实体名不一致,继续看 frontmatter 或 JSON 里的
name字段。 - 如果用户只给了模糊名字,先看实体
description、目录名和路由名,找到最可能的目标。 - 如果存在本地实体和插件实体同名,优先更新本地实体;插件实体不要直接修改,改用本地实体
extends插件实体。 - 如果用户要求更新插件实体,建议创建或更新本地派生实体,例如
extends: std/dev-reviewer。
不要直接修改这些上游或受管理位置:
node_modules/**packages/plugins/**<asset-root>/plugins/**/oneworks/**- 任意插件包或 marketplace 同步下来的实体文件
如果目标只存在于插件或上游来源,创建一个本地派生实体;如果本地已经有派生实体,就更新派生实体。
继续检查关联资产:
README.md或实体单文件:主体 prompt 和 frontmatter。INTRODUCTION.md、PERSONALITY.md、MEMORY.md:目录型实体的默认加载文件。rules:实体引用的长期约束。skills:实体引用的可复用流程。extends/inherit:实体继承关系。
更新策略
按用户真实意图选择最小变更:
- 改职责:优先更新
description和正文里的角色/边界。 - 改行为风格:优先更新
PERSONALITY.md,没有该文件时再考虑正文。 - 追加长期偏好或历史约定:优先更新
MEMORY.md。 - 增加稳定规范:优先引用或新增 rule,不要把大段规则塞进 prompt。
- 增加可复用操作流程:优先引用或新增 skill,不要把长流程塞进 entity。
- 基于已有实体改造:优先加
extends和少量差异化 prompt。 - 不想继承某字段:使用
inherit.<field>: replace或none,不要复制父实体再删内容。 - 如果目标是插件实体或共享上游实体,绝不直接编辑上游文件;用本地实体覆盖差异。
只有用户明确要求“重写”“重构”“替换整个实体”时,才大幅改写 prompt。
Frontmatter 更新
常见字段:
---
description: 更准确地描述这个实体何时应该被选择。
extends:
- std/dev-reviewer
inherit:
rules: replace
rules:
- frontend-standard
skills:
- frontend-review
tools:
include:
- Read
- Grep
---
维护原则:
description要面向路由选择,说明使用场景和职责。extends引用插件实体时使用scope/name,例如std/dev-reviewer。inherit只写需要偏离默认行为的字段。- 添加
rules/skills前先确认目标资产存在。 - 不要因为要继承父实体而写
plugins。
extends 设计原则:
- 只是补充项目差异时,加或保留
extends,不要复制父实体正文。 - 多父实体按列表顺序组合,顺序要反映能力优先级。
- 当前实体的
inherit只控制自己如何继承父实体组合结果。 - 不要在更新任务里引入高级 per-parent 策略。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 144 lines · 33 tokens per session scan A 9236912fcf16
update-entity is a skill published in the GitHub repository oneworks-ai/app (20 stars, last pushed 1mo ago), licensed MIT. It adds 33 tokens to every session and 1,498 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
spec-kitty-charter-doctrine
Run charter interview, generation, context, and sync workflows for project governance in Spec Kitty 3.x. Access doctrine artifacts programmatically via DoctrineService. Resolve agent profiles. Load action-scoped governance context iteratively, not all at once. Triggers: "interview for charter", "generate charter"…
chisle-audit
One-shot efficiency audit of a file, diff, or whole repo across BOTH axes at once: over-engineered code (reinvented stdlib, needless abstractions, speculative config) AND bloated prose (verbose comments, padded docstrings, redundant doc sections). Neither a pure code-minimizer nor a pure prose compressor does both in…
mongodb-query-optimizer
Help with MongoDB query optimization and indexing. Use only when the user asks for optimization or performance: "How do I optimize this query?", "How do I index this?", "Why is this query slow?", "Can you fix my slow queries?", "What are the slow queries on my cluster?", etc. Do not invoke for general MongoDB query…
polar-local-environment
This skill should be used when setting up or managing Polar local development environment with Docker.
execute
Execute an approved Maestro implementation plan using the shared session-state contract.
neo4j-modeling-skill
Design, review, and refactor Neo4j graph data models. Use when choosing node labels vs relationship types vs properties, migrating relational/document schemas to graph, detecting anti-patterns (generic labels, supernodes, missing constraints), designing intermediate nodes for n-ary relationships, enforcing schema with…