Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pingfanfan/hello-dsh/dsh-skill-devnpx skills add pingfanfan/hello-dsh --skill dsh-skill-devgit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-skill-dev)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-skill-dev"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/dsh-skill-dev.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.01567 |
| Opus 5 | $0.00030 | $0.00783 |
| Sonnet 5 | $0.00012 | $0.00313 |
| Haiku 4.5 | $0.00006 | $0.00157 |
Grade A, and why
dsh-skill-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
给 DSH 写技能
技能是 DSH 里成本最低的扩展方式：一个 Markdown 文件，不写代码，不构建，不发包，改完不重启。
本文规则来自官方 packages/skill/skill-filesystem/README.md 与 packages/skill/tool-skill/README.md。涉及版本行为时以实际运行结果为准，不要照抄记忆。
最小形态
~/.dsh/skills/<name>/SKILL.md # 目录形式，可带附加资源
~/.dsh/skills/<name>.md # 或扁平单文件
---
name: my-skill
description: 当需要做某件具体的事时使用。
---
（正文是直接交给模型的指令）
嵌套的 **/SKILL.md 不会被发现，只扫一层。
发现路径
按 rank 排序，数字小的优先，同名时高优先级胜出：
| Rank | 来源 | 路径 |
|---|---|---|
| 100 | project-dsh |
<项目>/.dsh/skills |
| 200 | project-agents |
<项目>/.agents/skills |
| 300 | custom |
配置的自定义目录 |
| 400 | user-dsh |
~/.dsh/skills |
| 500 | user-agents |
~/.agents/skills |
项目根 = 最近的含 .git 的祖先目录，没有则用当前工作目录。
~/.agents/skills 是跨 agent 共享目录，Claude Code 等工具的技能放这里 DSH 也能发现。
三个必须知道的行为
一、fail-closed：写错键名整条丢弃
调用策略的键名必须是 kebab-case。写成驼峰，整个技能被丢弃，不是忽略那个字段：
user-invocable: true # 对
userInvocable: true # 整条技能消失，只有一条警告
disable-model-invocation: false # 对
disableModelInvocation: false # 整条技能消失
值也必须是布尔或可接受的布尔词（true/false、yes/no、on/off、1/0，大小写不敏感）。写 maybe 同样导致整条丢弃。
这是有意的安全设计：一个声明了"不要暴露给用户"的技能，如果因为拼写错误被宽容处理，就会出现在本不该出现的界面上。丢弃比错误暴露安全。
排查顺序：技能没出现 → 先查 frontmatter 键名，再查路径。
二、description 决定它会不会被用到
模型最初只看到一份目录，里面只有每个技能的 name 和 description。正文要等模型决定加载之后才会被读进去。
所以 description 的唯一任务是让模型在正确时机想起它：
# 无效
description: 一个用于代码审查的技能
# 有效
description: 当需要审查代码改动、pull request 或 diff 时使用，按正确性、
生命周期、安全、测试强度的顺序给出中文审查意见。
写法：以「当……时使用」开头，再说清它会做什么。这是官方 11 个技能的统一格式。
三、正文改动即时生效
每次加载都会重新读取文件，所以改正文不需要任何缓存失效动作。
目录也会在会话中途刷新。 tool-skill 在每个 agent/pre-step 都会重新快照一次目录，membership 或 description 变化时会向会话追加一份完整的替换目录。所以会话进行到一半时新建的技能，下一步就能被发现并加载，不需要开新会话。（实测确认过：会话开始后创建技能目录，同一次运行里模型就能加载到它。）
会触发目录重新发现的：新增/删除技能目录、SKILL.md 的增删改、扁平 .md 的增删。
不会触发的：references/、scripts/、assets/ 下的改动。
正文怎么写
参照官方自己的写法（仓库 .agents/skills/，11 个）：
- 开头声明这是判断指引，不是清单。 清单会让模型机械打勾，判断标准让它权衡。
- 列出事实来源，并说明「读它，不要复述它」。 防止技能变成会过期的二手资料。
- 分层：阻断项 / 检查项 / 不要做的事。 优先级要显式。
- 给正例反例对照。 比抽象描述有效得多。
- 单独写「不要做的事」。 模型有默认倾向，不明说就会做。这一节挡住的问题往往比「要做什么」更多。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 128 lines · 59 tokens per session scan A 7d977a285aec
dsh-skill-dev is a skill published in the GitHub repository pingfanfan/hello-dsh (87 stars, last pushed 21d ago), licensed MIT. It adds 59 tokens to every session and 1,567 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
dsh-web-release
Release and publish the dsh-web monorepo (DSH Web GUI plugin family + skin collection) — bump all packages to one unified version, commit and tag (tags are cut from main after dev integration; dev is the integration branch), push the vX.Y.Z tag that triggers the GitHub Actions publish pipeline, and verify the npm…
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-web-pre-push-checks
Use before pushing, opening or updating a pull request, or claiming dsh-web checks pass. Selects the required repository gates and diff-specific generation, build, and GUI evidence.
dsh-web-documentation
Use when adding or editing dsh-web README files, docs, AGENTS.md instructions, user-facing configuration text, or bilingual documentation pairs.