Pinvou/pinvou-agent is an open-source desktop workspace where an AI agent helps with work, visual design, and software development. People use it to work with files and knowledge, create editable visual artifacts, connect coding agents to projects, and extend the workspace with tools, MCP servers, skills, and workflows; the catalogue skills add capabilities to that environment.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Pinvou/pinvou-agent --skill package-authorgit clone --depth 1 https://github.com/Pinvou/pinvou-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pinvou/pinvou-agent/package-author)<a href="https://agentmods.dev/skills/pinvou/pinvou-agent/package-author"><img src="https://agentmods.dev/badge/skills/pinvou/pinvou-agent/package-author/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pinvou/pinvou-agent/package-author"><img src="https://agentmods.dev/badge/skills/pinvou/pinvou-agent/package-author.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00133 | $0.01945 |
| Opus 5 | $0.00067 | $0.00972 |
| Sonnet 5 | $0.00027 | $0.00389 |
| Haiku 4.5 | $0.00013 | $0.00194 |
Grade A, and why
package-author scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
插件包标准化(package-author)
把用户给的工具/技能/脚本,整理成 pinvou 应用商店可导入的标准插件包。规范以
docs/plugin-package-spec.md 为准,本文件内置完整规则,可直接照做、不依赖文档可达。
何时用 / 何时不用
- ✅ 用:用户要打包/标准化一个工具,给了文件/目录/脚本/SKILL.md/manifest.json/zip,或口头描述要一个插件包。
- ❌ 不用:用户只是"写个脚本"/"写个技能内容"而没说要打包;或是在装/卸载/开关某个已存在的工具。
先弄清三件事(问清再动手,别猜)
- 输入在哪:用户给的是目录路径、粘贴的代码、还是 zip?文件类型是什么?
- 包类型:纯技能?纯 MCP?还是 MCP+技能组合?(见 §类型判定)
- 输出形态:要一个目录(可直接 zip),还是直接产出 zip?
若用户没给 id/名称,按内容起一个语义化小写 id(如 weather-insight),并告诉用户可改。
类型判定(决定布局)
| 用户给的东西 | 类型 | 标准布局 |
|---|---|---|
| 只有 SKILL.md 或技能目录 | 纯技能 Skill | skills/<name>/SKILL.md |
| 一个 MCP server(脚本 + 描述) | 纯 MCP Mcp | mcp/manifest.json + mcp/server.py |
| MCP + 配套使用引导技能 | 组合 Bundle | mcp/ + skills/<name>/ 同时存在 |
标准包结构(必须落成这样)
<id>/
├── plugin.json ← 权威声明(见下)
├── mcp/ ← 纯 MCP / 组合包才有
│ ├── manifest.json
│ └── server.py
├── skills/<name>/ ← 纯技能 / 组合包才有
│ └── SKILL.md
└── icon.svg | icon.png ← 图标(缺失则生成,见 §图标)
plugin.json(schema v1)
{
"manifest_version": 1, // 必填,=1
"id": "weather-insight", // 必填,[a-z0-9-_]{1,64} 全小写
"name": "天气洞察", // 必填,展示名
"version": "1.0.0", // 可选(当前为预留字段,不驱动升级;更新包内容需更换包 id,或先删除 ~/.pinvou3/bundles/<id>/ 再导入)
"description": "聚合天气查询与解读", // 可选
"icon": "icon.svg", // 可选,相对根,icon.svg/icon.png
"components": { // 多组件用
"mcp_servers": [ { "id": "weather", "dir": "mcp" } ],
"skills": [ { "id": "weather-interpret", "dir": "skills/weather-interpret" } ]
}
}
硬规则:
id全小写[a-z0-9-_],禁./../路径分隔符;name可任意可读文本。components.mcp_servers[].dir写"mcp"(扁平单 server);skills 的dir写"skills/<name>",且<name>必须等于该 SKILL.md frontmatter 的name。- 纯单组件可省略
plugin.json(导入走结构回退),但标准化输出一律补上(自描述)。 - 未知字段别乱加;当前只认
components{mcp_servers,skills}。
MCP 组件:mcp/manifest.json
本地 stdio server(最常见):
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed da8f8cf03e24
- 9d ago First seen · 139 lines · 133 tokens per session scan A f809b1475e7e
package-author is a skill published in the GitHub repository Pinvou/pinvou-agent (1,712 stars, last pushed today), licensed MIT. It adds 133 tokens to every session and 1,945 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-creator
A skill for creating, editing, improving, and testing skills for coding agents.
algorithmic-art
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright…
docx
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when…
claude-api
Build apps with the Claude API or Anthropic SDK. TRIGGER when: code imports anthropic/@anthropic-ai/sdk/claudeagentsdk, or user asks to use Claude API, Anthropic SDKs, or Agent SDK. DO NOT TRIGGER when: code imports openai/other AI SDK, general programming, or ML/data-science tasks.
doc-coauthoring
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers.…
canvas-design
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.