Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/op7418/codepilot/feishu-bitablenpx skills add op7418/CodePilot --skill feishu-bitablegit clone --depth 1 https://github.com/op7418/CodePilotWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00159 | $0.03094 |
| Opus 5 | $0.00079 | $0.01547 |
| Sonnet 5 | $0.00032 | $0.00619 |
| Haiku 4.5 | $0.00016 | $0.00309 |
Grade A, and why
feishu-bitable scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
The source is not reproduced here
No licence file
A repository with no LICENSE is all rights reserved by default, so the body is not copied here. The metadata, the measurements and the link are.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 249 lines · 159 tokens per session scan A 5cf13df82130
feishu-bitable is a skill published in the GitHub repository op7418/CodePilot (6,439 stars, last pushed today), with no licence file. It adds 159 tokens to every session and 3,094 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deepseek-harness-eac-dev
面向 Deepseek Harness EAC 源码仓库的全栈开发与维护技能。处理 Tauri/Rust 桌面壳、Node sidecar、Web bridge、DSH 插件与 preset、profile 治理、更新打包、可靠性修复、测试验收和发布准备时使用；不用于客户端功能使用说明，也不负责专项 JS 到 TS 迁移。.
imap-smtp-email
Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Works with any IMAP/SMTP server including Gmail, Outlook, 163.com, vip.163.com, 126.com, vip.126.com, 188.com, and vip.188.com.
eac-desktop-tips
Deepseek Harness EAC 桌面客户端功能速查 —— 退出后台运行、对话回退、插件市场、桌面宠物、Skills 与 MCP 管理等特性的使用方法与排障入口。当用户询问本客户端某个功能怎么用、去哪找设置或某个内置行为不符预期时使用。.
katra
Chronicle development work in a committed, rich-component dev log as you build. Use when starting a piece of work that should be logged, when capturing a screenshot/gif/render into the log, when adding a before/after comparison, or at commit time to stamp the active draft with its hash + diffstat. Keywords - katra…
getvect
Convert a raster image (PNG, JPEG, BMP) into a vector file (SVG, EPS, DXF, PDF) locally, with no network call and no account. Use when you have generated or been given a bitmap and need clean editable paths — a logo to scale, line art to cut, a diagram to embed at any size. Do not use for photographs you want to keep…
release
Use when the maintainer wants to cut, prepare, or ship a code-by-wire release — e.g. says "bump version", "bump vX.Y.Z", "release it", "ship it", or "cut a release" — whether before the release (preparing the version bump and the changelog PR) or after the bump PR has merged (tagging and publishing).