Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/openbyteinc/quantdinger/quantdinger-agent-workflownpx skills add OpenByteInc/QuantDinger --skill quantdinger-agent-workflowgit clone --depth 1 https://github.com/OpenByteInc/QuantDingerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.01103 |
| Opus 5 | $0.00023 | $0.00551 |
| Sonnet 5 | $0.00009 | $0.00221 |
| Haiku 4.5 | $0.00005 | $0.00110 |
Grade A, and why
quantdinger-agent-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QuantDinger agent workflow
When this applies
Use this skill whenever you change code or docs under this repository as a coding agent (Cursor, Claude Code, Codex, or similar), especially:
backend_api_python/(Flask API, services, routes)- Strategy / backtest / trading-adjacent logic
docker-compose.yml,scripts/,env.exampledocs/agent/(keep English only)
Read first
docs/agent/AGENT_ENVIRONMENT_DESIGN.md- SSOT for three layers: documentation contract -> command contract -> optional HTTP/MCP.docs/agent/AI_INTEGRATION_DESIGN.md- How external AI agents consume QuantDinger as a product (Agent Gateway, scopes, MCP, trading safety). Read this before adding any new endpoint or tool that an AI agent might call.docs/agent/AGENT_QUICKSTART.md- Operator/integrator walkthrough; mirrors the implemented/api/agent/v1surface.docs/agent/agent-openapi.json- Machine-readable contract; update it whenever you add or change an/api/agent/v1/...route.docs/agent/README.md- Index of agent-facing docs.
Implemented surface (truth)
The Agent Gateway is mounted at /api/agent/v1 by app/routes/agent_v1/.
- Auth:
app/utils/agent_auth.py(@agent_required(scope=...)). Tokens are hashed at rest inqd_agent_tokens; never log or persist the raw token. - Async jobs:
app/utils/agent_jobs.pywrites toqd_agent_jobs; backtests and experiment pipelines submit here and clients poll/jobs/{id}or subscribe toGET /jobs/{id}/stream(SSE:snapshot/progress/ping/result). Long-running runners can opt in by adding a second positionalon_progressparameter.submit_jobwill detect it and pipe events to live SSE subscribers AND persist the latest snapshot. - Audit: every call (success and denial) is appended to
qd_agent_audit. - Trading:
quick_trade.pyenforces paper-only by default; live execution requires bothpaper_only=falseon the token AND envAGENT_LIVE_TRADING_ENABLED=true. Do not weaken this without explicit ask. - MCP:
mcp_server/is a thin Python wrapper over R + W + B endpoints (no trading), with three transports selected byQUANTDINGER_MCP_TRANSPORT:stdio(default, desktop IDEs),sse, andstreamable-http(cloud agents / remote IDEs; also bindQUANTDINGER_MCP_HOST/QUANTDINGER_MCP_PORT). Add new tools there only after exposing the underlying capability via REST. - Admin UI: the Vue project at
QuantDinger-Vue-src/ships Profile -> My Agent Token for every logged-in user (src/views/profile/components/ProfileAgentTokens.vue, API/api/agent/v1/me/tokens). Admins retain/agent-tokensfor audit. API client lives insrc/api/agent.js.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 80 lines · 47 tokens per session scan A 33614625a305
quantdinger-agent-workflow is a skill published in the GitHub repository OpenByteInc/QuantDinger (11,264 stars, last pushed today), licensed Apache-2.0. It adds 47 tokens to every session and 1,103 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
options-trading
Use before researching, selecting, opening, modifying, or closing any option position, including single-leg options, vertical spreads, iron condors, butterflies, straddles, strangles, calendars, and other multi-leg structures. Also use when a broad trading mandate leads you to consider options even if the user did not…
stock-trading
Use before researching, selecting, opening, modifying, or closing a stock or ETF position, including discretionary investing, rotation, breakout, momentum, mean-reversion, opening-range breakout, and VWAP trading. Also use when a broad mandate leads you to consider stocks or ETFs even if the user did not name an asset…
google-agents-cli-deploy-readiness-aisp
This skill should be used when the user wants to "deploy with human approval", "verify a deployment approval", "resolve the effective agents-cli deploy plan", or needs a forced-blocking gate before agents-cli deploy. Covers resolving CLI flags + agents-cli-manifest.yaml into a plan, presenting that plan at…
invinoveritas
Pay-per-call agent tools over Bitcoin Lightning / USDC (x402), exposed as a remote MCP server. Use BEFORE any irreversible or consequential action (a trade, a destructive command, shipping code, spending funds) to get a capital-scale-aware governance review; for facts-only crypto market intelligence (macro risk…
verification-handshake
The agent-to-agent trust handshake. Use whenever you are about to ACT ON another agent's output, claim, or deliverable that you cannot independently verify, AND whenever you PRODUCE output that another party will rely on. Demand a proof on what you receive; attach a proof to what you ship. A proof is a portable…
pre-action-review
Get an independent, signed verdict from invinoveritas before an irreversible or high-consequence action — a force-push, a merge to main, a production deploy, a destructive shell command, a schema migration, a fund transfer, or any action a hidden agent flaw could make hard to undo. Use before executing, not after.