Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add openyida/openyida --skill yida-form-permissiongit clone --depth 1 https://github.com/openyida/openyidaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openyida/openyida/yida-form-permission)<a href="https://agentmods.dev/skills/openyida/openyida/yida-form-permission"><img src="https://agentmods.dev/badge/skills/openyida/openyida/yida-form-permission/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openyida/openyida/yida-form-permission"><img src="https://agentmods.dev/badge/skills/openyida/openyida/yida-form-permission.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.03313 |
| Opus 5.5 | $0.00017 | $0.01325 |
| Sonnet 5.5 | $0.00008 | $0.00663 |
| Haiku 4.5 | $0.00004 | $0.00331 |
Grade A, and why
yida-form-permission scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
表单权限配置
适用范围
查询、新增或修改表单权限组时使用。
查询按每页 20 条安全翻页；达到安全上限、分页重复或响应结构不完整时必须停止，不把不完整列表当作全量权限组。
查询返回 roleDataComplete: false 时，成员信息仅供查看，尚不能确认完整排除规则；不得据此更新已有权限组。遇到 SAVE_PERMISSION_BEFORE_UNKNOWN 时保持零写入。
| 类型 | 管什么 | 参数 |
|---|---|---|
| VIEW | 查看和管理已有数据 | 默认 FORM_PACKAGE_VIEW |
| START | 发起和提交 | 查询、保存、复核都传 --package-type FORM_PACKAGE_START |
按任务选择
| 要做什么 | 读取说明 |
|---|---|
| 配成员、角色、可访问的数据和字段 | 成员、数据范围与字段权限 |
| 按字段、当前登录人、部门组合筛选数据 | 按字段组合数据范围 |
| 复制、重命名或删除权限组 | 权限组管理 |
| 查询或维护组织矩阵 | 组织矩阵管理，先核对组织管理权限 |
各维度按用户要求独立配置。普通数据条件不要求配置矩阵。
铁律
- 目标必须唯一：优先使用查询结果中的
packageUuid，通过--package-uuid精确更新；未提供 UUID 时才按DEFAULT、MANAGER或MATRIX匹配。匹配 0 个或多个、分页无法完整结束时停止。packageUuid只属于本次查询的formUuid；多表单配置必须逐表查询，禁止跨表单复用，也禁止跨权限组类型复用。 - 未知操作键必须保留：目标组的
operatePermit包含 CLI 白名单外键时，停止 action-permission 修改；修改其他维度时原样保留整个operatePermit。 - 成员替换必须展示损失：执行
--all-members或--matrix前展示完整 roleData before/after 和会移除的DEPARTMENT、ROLE、PARAM、MANAGER等条目。CLI 要求确认时，用户确认后追加--confirm-member-replace。 - 整块保存必须先确认：action-permission 会整块替换为 operations 中值为 true 的白名单键；执行前展示完整 before/after。
- 平台状态是真相源：本技能不使用 memory 保存权限状态；CLI 保存前完整查询、只写一次，保存后按 packageUuid 精确回读。目标维度不一致或非目标维度漂移时报
verify failed；无法恢复 create UUID、精确目标暂不可见或回读失败时报verify unknown，两者都不得宣称成功或直接重放写入。
标准流程
- 查询：运行
openyida get-permission <appType> <formUuid>；查 START 时加上表中的类型参数。记录目标组名称、packageUuid，以及 roleData、dataPermit、operatePermit、fieldPermit 四个维度。 - 差异预览：输出明确的
before与after；未修改的 roleData、dataPermit、operatePermit、fieldPermit 标记为“保持原值”。 - 确认：向用户确认唯一目标、成员损失、操作权限整块替换和数据范围变化。
- 写入：只传需要修改的维度，更新时追加
--package-uuid <packageUuid>，执行一次save-permission。 - 重查验证：CLI 会自动按 packageUuid 做 canonical readback，并返回
verification.status=verified才算成功；Agent 可再用精确查询复核。failed或unknown时停止且不重放。
新增权限组也先查询现有配置并展示新组的完整 after，再确认、写入和重查。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +10 lines dd506227332d
- 9d ago Changed · +47 lines · -4 tokens per session ec194f8cc06e
- 1mo ago Changed · +6 lines 7d2d918c689a
- 1mo ago First seen · 156 lines · 46 tokens per session scan A d92fee88f95d
yida-form-permission is a skill published in the GitHub repository openyida/openyida (228 stars, last pushed today), licensed MIT. It adds 42 tokens to every session and 3,313 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
iflytek-contract-intelligence-review
A contract-review workflow for scanned or digital agreements. It can recognize document text, examine clauses, detect risks, check compliance, and create translation summaries; its output is for review and is not formal legal advice.
appstore-review-checker
Audit iOS/macOS apps against App Store Review Guidelines before submission, with evidence-backed verdicts and fixes. Don't use for Google Play, general code review, or rejection appeals.
brand-name-checker
Check product and brand names for conflicts across trademarks, domains, social handles, and package registries. Returns a risk level and Proceed/Modify/Abandon verdict. Don't use for name brainstorming, logo design, or trademark filings.
regulatory-analysis
Analyzes documents and processes against FINRA, SEC, Federal Reserve, and CFPB regulatory frameworks. Identifies compliance gaps, classifies findings by severity, and recommends remediation. Use when performing compliance audits, regulatory reviews, gap analyses, or verifying policy adherence to financial regulations.
document-review
Reviews financial documents (prospectuses, ADVs, marketing materials) for FINRA 2210 compliance, required disclosures, and balanced presentation. Use when reviewing financial statements, audit documents, regulatory filings, or when the user mentions compliance checks, financial audits, or document verification.
azure-health-data-services
Expert knowledge for Azure Health Data Services development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when using FHIR/DICOM APIs, bulk import/export, de-identification…