Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OpenDCAI/DataFlow-WebUI --skill dataflow-devgit clone --depth 1 https://github.com/OpenDCAI/DataFlow-WebUIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/opendcai/dataflow-webui/dataflow-dev)<a href="https://agentmods.dev/skills/opendcai/dataflow-webui/dataflow-dev"><img src="https://agentmods.dev/badge/skills/opendcai/dataflow-webui/dataflow-dev/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/opendcai/dataflow-webui/dataflow-dev"><img src="https://agentmods.dev/badge/skills/opendcai/dataflow-webui/dataflow-dev.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 45 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 45 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 49 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 49 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 146 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 146 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Data Exfiltration · line 134 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00095 | $0.03985 |
| Opus 5.5 | $0.00038 | $0.01594 |
| Sonnet 5.5 | $0.00019 | $0.00797 |
| Haiku 4.5 | $0.00010 | $0.00398 |
Grade A, and why
dataflow-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 319 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DataFlow 开发助手 (dataflow-dev)
仓库级变更策略（哪些改动被允许）不属于本技能。当你在 DataFlow-WebUI 仓库内工作时， 以该仓库根目录的
CLAUDE.md为唯一真源。
激活时执行的步骤
不要预先加载全部参考文件。 三份参考共约 1400 行；先按意图路由，只读用得上的那一份。
- 探测仓库状态（在 DataFlow 仓库根目录下执行）：
git branch --show-current # 当前分支 git log --oneline -3 # 最近提交 git diff --name-only HEAD~1 HEAD # 最近一次变更文件列表 - 向用户报告当前上下文摘要（1-3行，不要冗长）
- 判断用户意图，按下表只读所需文件，然后进入对应工作流
按需加载表
| 用户意图 | 需要读取 | 不需要读取 |
|---|---|---|
| 新建算子 / Pipeline / Prompt | ${SKILL_DIR}/context/dev_notes.md（规范）；写算子时另加 context/knowledge_base.md 的 §3 算子章节 |
诊断表 |
| 报错 / 诊断 | ${SKILL_DIR}/diagnostics/known_issues.md（先查快速匹配表，命中后只读对应 Issue 小节） |
知识库全文、开发规范 |
| 代码审查 / 规范检查 | ${SKILL_DIR}/context/dev_notes.md |
知识库全文、诊断表 |
| 查 API / 架构问题 | ${SKILL_DIR}/context/knowledge_base.md 中相关章节（按标题定位，不要通读） |
诊断表、开发规范 |
| 知识库更新感知 | 三份都要，因为要逐一比对 | — |
参考文件用途：
context/knowledge_base.md— 架构与 API 参考（约 670 行，按章节查阅）context/dev_notes.md— 开发规范与最佳实践diagnostics/known_issues.md— 已知问题诊断表（Issue #001–#009）
有 MCP 时：算子签名以 get_operator_detail_by_name 为准，它反映实际安装的版本；知识库是静态快照，冲突时以 MCP 为准。
离线模式：以随技能提供的知识库和 core_text 静态参考为准；如果本地 DataFlow 版本不同，使用 Python 的 inspect.signature 做一次本地核对，并说明无法查询实时注册表。
子命令路由
根据用户意图，路由到对应工作流：
| 用户意图关键词 | 执行流程 |
|---|---|
| 新建算子 / new operator / create operator | → 算子创建流程 |
| 新建 Pipeline / new pipeline | → Pipeline 创建流程 |
| 新建 Prompt / new prompt | → Prompt 创建流程 |
| 报错 / error / KeyError / AttributeError / Warning | → 诊断流程 |
| 审查代码 / check / review / 规范检查 | → 规范审查流程 |
| 更新知识库 / sync / check updates / 仓库有新算子 | → 知识库更新感知流程 |
算子创建流程
Step 1: 防重复检查（必须）
在生成代码前，先检查是否已有功能相近算子：
# 查看各模块已注册算子
grep -r "^from \." dataflow/operators/general_text/__init__.py | grep TYPE_CHECKING -A 200 | grep "^ from"
grep -r "^ from" dataflow/operators/text_sft/__init__.py
grep -r "^ from" dataflow/operators/reasoning/__init__.py
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 319 lines · 95 tokens per session scan A 06d517528c41
dataflow-dev is a skill published in the GitHub repository OpenDCAI/DataFlow-WebUI (253 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 95 tokens to every session and 3,985 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gemini-api-agent-platform
Guides the usage of the Gemini API on Agent Platform with the Google Gen AI SDK for enterprise AI applications. Covers SDK usage (Python, JS/TS, Go, Java, C#), capabilities like Live API, tools, multimedia generation, caching, and batch prediction.
open-source
Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browseruse, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle…
deepstream-sop
Use this skill when building, deploying, evaluating, debugging, or measuring latency for the DeepStream SOP Inference Microservice — a GPU-accelerated FastAPI service that detects whether operators perform assembly-line steps in order via event boundary detection (GEBD) plus VLM classification. Trigger even if the…
gemini-api-dev
Use this skill when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, video generation, speech generation (TTS), voice design, voice replication, streaming responses, background research tasks, function calling, structured output, or migrating from…
azure-search-documents-dotnet
Azure AI Search SDK for .NET (Azure.Search.Documents). Use for building search applications with full-text, vector, semantic, and hybrid search. Covers SearchClient (queries, document CRUD), SearchIndexClient (index management), and SearchIndexerClient (indexers, skillsets). Triggers: "Azure Search .NET"…
data-engineering
A guide to data engineering, the work of collecting, moving, processing, and checking data. It covers workflow tools such as Airflow, Dagster, and Prefect, plus streaming and data-quality tools.