Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pingfanfan/hello-dsh --skill ask-good-questionsgit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/ask-good-questions)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/ask-good-questions"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/ask-good-questions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/ask-good-questions"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/ask-good-questions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 29 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01015 |
| Opus 5 | $0.00030 | $0.00508 |
| Sonnet 5 | $0.00012 | $0.00203 |
| Haiku 4.5 | $0.00006 | $0.00102 |
Grade A, and why
ask-good-questions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
提一个能被回答的问题
判断标准：对方看完能不能开始动手？ 不能，就还缺信息。
维护者时间有限。一个带完整信息的问题会被认真对待，「用不了」不会。这不是态度问题，是对方确实无从下手。
必须包含的
一、版本与环境
- 软件版本（跑一遍
--version，不要凭印象） - 操作系统与版本
- 运行时版本（Node、Python 等）
- 安装方式（npm / 源码 / 容器）
不要写「最新版」。 你的最新版和对方的最新版可能不是同一个。
二、最小复现
从一个干净环境开始，删掉所有跟问题无关的部分，直到再删就不复现为止。
1. mkdir /tmp/repro && cd /tmp/repro
2. npx some-tool init
3. 把下面这段写进 config.yml：
<完整内容>
4. 运行 npx some-tool run
5. 观察到：<实际发生了什么>
最小化这件事本身经常就能定位问题。 删到一半发现不复现了，那你就找到原因了。
三、预期与实际
分开写：
预期：加载 5 个技能
实际：只加载了 3 个，缺 foo 和 bar，没有任何报错
只写「不工作」的问题无法回答，因为对方不知道你期望什么。
四、完整报错
贴全文，包括堆栈。不要截断，不要转述。
脱敏这些：
- API key、token、密码
- 完整主目录路径（换成
~） - 内部域名、IP
- 业务数据
用代码块包起来，不要贴截图（搜不到、看不清、无法复制）。
五、你已经试过什么
这一条经常被省略，但它能省掉一整轮往返：
已排除：
- 换了 Node 22 和 24，都一样
- 删掉 node_modules 重装，一样
- 在另一台 macOS 上复现了
标题
标题决定它会不会被点开。
✗ 求助
✗ 有人遇到过这个问题吗
✗ Bug
✓ 技能目录里的文件不被发现，frontmatter 用了驼峰键时无任何报错
公式：症状 + 条件。让人一眼判断是不是自己熟悉的领域。
报 bug 之前
先排除这几种情况，否则容易浪费双方时间：
- 看文档 —— 尤其是 FAQ 和 troubleshooting
- 搜已有的 issue/discussion —— 包括已关闭的
- 换个环境试 —— 是不是你机器特有的
- 确认是 bug 不是预期行为 —— 有时候它就是这么设计的
提功能建议
跟报 bug 不同，要写清楚：
- 你实际想解决什么问题，不是你想要什么方案
- 当前你怎么绕过的，绕不过就说绕不过
- 多少人会受益，只有你一个人也可以说，但要诚实
先说问题再说方案。 直接提方案会限制对方的思路，而且你的方案可能不是最优的，甚至可能已经有更好的现成办法。
跟进
- 对方问了信息，尽快补
- 自己解决了，回来说一下怎么解决的，这对后来搜到的人有价值
- 不再需要了就关掉
不要做的事
- 不要贴截图代替文本（无法搜索、无法复制）
- 不要说「紧急」「请尽快」，除非你在付费支持渠道
- 不要在多个地方重复问同一个问题
- 不要 @ 维护者催
- 不要贴上万行日志，贴相关的那段
- 不要省略你觉得「应该不重要」的环境细节
- 不要泄漏凭据，发出去就要当作已泄漏，立刻轮换
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 119 lines · 61 tokens per session scan A dd261aa22552
ask-good-questions is a skill published in the GitHub repository pingfanfan/hello-dsh (90 stars, last pushed 27d ago), licensed MIT. It adds 61 tokens to every session and 1,015 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
systematic-debugging
Diagnose failures from runtime evidence before editing code.
diagnosing-bugs
A structured workflow for finding the cause of difficult bugs and performance slowdowns. It first builds a small, repeatable check that clearly shows whether the problem is present, then uses tests, scripts, traces, or comparisons to investigate it.
dsh-debug-session
A troubleshooting guide for DSH startup failures, inactive plugins, and broken sessions. It describes collecting logs, narrowing down causes, backing up configuration, and rolling back changes.
diagnosing-bugs
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…