Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pingfanfan/hello-dsh/web-researchnpx skills add pingfanfan/hello-dsh --skill web-researchgit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/web-research)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/web-research"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/web-research.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00941 |
| Opus 5 | $0.00027 | $0.00470 |
| Sonnet 5 | $0.00011 | $0.00188 |
| Haiku 4.5 | $0.00005 | $0.00094 |
Grade A, and why
web-research scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
联网调研
结论必须能追到一手来源。 追不到的，要么不写，要么明确标成推测。
一手优先
信息可信度从高到低：
- 一手：官方文档、源码、论文原文、官方公告、当事人原话
- 二手：技术博客、新闻报道、会议演讲转述
- 三手：聚合类文章、"XX 大盘点"、AI 生成的摘要
只有一手能作为结论的依据。 二手用来发现线索，然后去找它引用的一手。三手基本只能用来判断"这个话题有人在讨论"。
一个具体动作：看到「据报道 X 团队称 Y」，先找到 X 团队自己在哪儿说的。转述链要捋到底，经常会发现转述过程中语义漂移了。
时效性
技术类信息尤其容易过期。每条关键结论都要确认：
- 这个来源是什么时候发布的
- 它描述的版本是哪个
- 现在的版本还是这样吗
「某某不支持某功能」这类断言最容易过期，下结论前去看当前版本的文档或 changelog。
否定性断言要加倍小心
「查无此事」比「确有此事」更容易翻车，因为你搜不到不等于不存在。
下这类结论前：
- 中英文各搜一轮
- 换几个不同的说法搜
- 如果涉及某个项目/机构，直接去它的官网或仓库确认
仍然不确定，就把结论削弱成「我没能找到相关信息」，而不是「不存在」。这两句话的可靠性差很远。
交叉验证
关键结论至少两个独立来源。注意「独立」的含义：三篇都引用同一条推文的文章，是一个来源不是三个。
出现冲突时不要挑一个信，而是：
- 看哪个更接近一手
- 看时间先后（是不是后来更正了）
- 两个都保留，把分歧写出来
输出
每条事实性陈述都要能对应到来源。 具体做法：
DSH 于 2026 年 8 月 13 日开源，采用插件化架构。
来源：https://github.com/deepseek-ai/deepseek-harness（仓库创建时间与 README）
区分三种表述强度，不要混用：
| 强度 | 用词 | 什么时候用 |
|---|---|---|
| 确认 | 「是」「已经」 | 有一手来源 |
| 推断 | 「大概率」「看起来」 | 有间接证据 |
| 猜测 | 「我猜」「如果……那么」 | 没有证据，只有逻辑推理 |
禁止把推断写成确认。 这是调研里最常见也最有害的错误。
数字要格外小心
具体数字（价格、性能、日期、规模）是最容易被以讹传讹的。每个数字都要追到一手，追不到就不写具体数，改成「量级上」的描述。
绝对不要凭记忆写数字。 记忆里的数字看起来很确定，但经常是错的，而且错得很具体，读者无法察觉。
不要做的事
- 不要把搜索结果的摘要当成事实，点进去看原文
- 不要引用引用别人的文章，追到源头
- 不要用"业界普遍认为"这类无法核实的表述
- 不要把 AI 生成的内容当来源
- 不要在没有来源的情况下写具体数字和日期
- 不要把"我没搜到"写成"不存在"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 85 lines · 54 tokens per session scan A 93ec37724346
web-research is a skill published in the GitHub repository pingfanfan/hello-dsh (89 stars, last pushed 22d ago), licensed MIT. It adds 54 tokens to every session and 941 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-sdk-upgrade
Safely select and install a compatible official @deepseek-ai SDK release for dsh plugin projects (dsh-web, dsh-trading, and similar monorepos) from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled rollout — including syncing the project's declared DSH host-version floor…
dsh-web-sdk-compatibility
Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…
dsh-web-pet-developer
Create a pet for the dsh-pet plugin and integrate it into the dsh web GUI — author a v2 pet.json manifest plus an 8-column x 9-row atlas per the Codex/hatch-pet contract (live2d pets, voice packs and status decorations included), drop it into the pet-center user directory or contribute it as a built-in asset under…