Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pingfanfan/hello-dsh --skill ask-good-questionsgit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/ask-good-questions)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/ask-good-questions"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/ask-good-questions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/ask-good-questions"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/ask-good-questions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 29 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01015 |
| Opus 5.5 | $0.00024 | $0.00406 |
| Sonnet 5.5 | $0.00012 | $0.00203 |
| Haiku 4.5 | $0.00006 | $0.00102 |
Grade A, and why
ask-good-questions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
提一个能被回答的问题
判断标准：对方看完能不能开始动手？ 不能，就还缺信息。
维护者时间有限。一个带完整信息的问题会被认真对待，「用不了」不会。这不是态度问题，是对方确实无从下手。
必须包含的
一、版本与环境
- 软件版本（跑一遍
--version，不要凭印象） - 操作系统与版本
- 运行时版本（Node、Python 等）
- 安装方式（npm / 源码 / 容器）
不要写「最新版」。 你的最新版和对方的最新版可能不是同一个。
二、最小复现
从一个干净环境开始，删掉所有跟问题无关的部分，直到再删就不复现为止。
1. mkdir /tmp/repro && cd /tmp/repro
2. npx some-tool init
3. 把下面这段写进 config.yml：
<完整内容>
4. 运行 npx some-tool run
5. 观察到：<实际发生了什么>
最小化这件事本身经常就能定位问题。 删到一半发现不复现了，那你就找到原因了。
三、预期与实际
分开写：
预期：加载 5 个技能
实际：只加载了 3 个，缺 foo 和 bar，没有任何报错
只写「不工作」的问题无法回答，因为对方不知道你期望什么。
四、完整报错
贴全文，包括堆栈。不要截断，不要转述。
脱敏这些：
- API key、token、密码
- 完整主目录路径（换成
~） - 内部域名、IP
- 业务数据
用代码块包起来，不要贴截图（搜不到、看不清、无法复制）。
五、你已经试过什么
这一条经常被省略，但它能省掉一整轮往返：
已排除：
- 换了 Node 22 和 24，都一样
- 删掉 node_modules 重装，一样
- 在另一台 macOS 上复现了
标题
标题决定它会不会被点开。
✗ 求助
✗ 有人遇到过这个问题吗
✗ Bug
✓ 技能目录里的文件不被发现，frontmatter 用了驼峰键时无任何报错
公式：症状 + 条件。让人一眼判断是不是自己熟悉的领域。
报 bug 之前
先排除这几种情况，否则容易浪费双方时间：
- 看文档 —— 尤其是 FAQ 和 troubleshooting
- 搜已有的 issue/discussion —— 包括已关闭的
- 换个环境试 —— 是不是你机器特有的
- 确认是 bug 不是预期行为 —— 有时候它就是这么设计的
提功能建议
跟报 bug 不同，要写清楚：
- 你实际想解决什么问题，不是你想要什么方案
- 当前你怎么绕过的，绕不过就说绕不过
- 多少人会受益，只有你一个人也可以说，但要诚实
先说问题再说方案。 直接提方案会限制对方的思路，而且你的方案可能不是最优的，甚至可能已经有更好的现成办法。
跟进
- 对方问了信息，尽快补
- 自己解决了，回来说一下怎么解决的，这对后来搜到的人有价值
- 不再需要了就关掉
不要做的事
- 不要贴截图代替文本（无法搜索、无法复制）
- 不要说「紧急」「请尽快」，除非你在付费支持渠道
- 不要在多个地方重复问同一个问题
- 不要 @ 维护者催
- 不要贴上万行日志，贴相关的那段
- 不要省略你觉得「应该不重要」的环境细节
- 不要泄漏凭据，发出去就要当作已泄漏，立刻轮换
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 119 lines · 61 tokens per session scan A dd261aa22552
ask-good-questions is a skill published in the GitHub repository pingfanfan/hello-dsh (104 stars, last pushed 1mo ago), licensed MIT. It adds 61 tokens to every session and 1,015 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
systematic-debugging
Diagnose failures from runtime evidence before editing code.
diagnosing-bugs-zh
A diagnostic workflow for difficult bugs and performance regressions, meaning cases where software behaves incorrectly or becomes slower after a change.
dsh-debug-session
A troubleshooting guide for DSH startup failures, inactive plugins, and broken sessions. It describes collecting logs, narrowing down causes, backing up configuration, and rolling back changes.
dsh-speed-up-perf
Use when investigating or optimizing DeepSeek Harness performance, designing realistic synthetic benchmarks or CI performance gates, profiling long Sessions or Web responsiveness, or turning performance PR evidence into measured behavior-preserving fixes.
dsh-ci-test-reliability
Design, review, and diagnose DeepSeek Harness tests and fixtures that can fail nondeterministically under CI concurrency, shared host resources, clocks, process-global state, subprocesses, network listeners, or asynchronous teardown. Use when adding or changing tests with those risks, investigating flaky CI, or…