Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sazardev/shiki/deploynpx skills add sazardev/shiki --skill deploygit clone --depth 1 https://github.com/sazardev/shikiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00146 | $0.02716 |
| Opus 5 | $0.00073 | $0.01358 |
| Sonnet 5 | $0.00029 | $0.00543 |
| Haiku 4.5 | $0.00015 | $0.00272 |
Grade C, and why
deploy scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
cd /tmp && rm -rf hb && git clone https://github.com/sazardev/homebrew-shiki.git hb Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
land on crates.io (verify each: `curl -s -H "User-Agent: …" https://crates.io/api/v1/crates/<crate>`). How it starts
The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Shiki release runbook (verified on v0.9.1)
The complete flow for publishing a shiki release, in order. Every command below was exercised for the v0.9.1 cut. Do the steps in sequence and verify each checkpoint before moving on. The three fallbacks in Phase 6–8 are part of the real flow, not exceptional edge cases.
Phase 0 — preflight
- Working tree clean, on
main, up to date:git status --short,git log --oneline -3. - Know the target version (next patch/minor from
[workspace.package] versionin rootCargo.toml). Default: next patch (0.9.1→0.9.2). - Enumerate what's changed since the last tag:
git log --oneline <last-tag>..main(e.g.git log --oneline v0.9.1..main).
Phase 1 — CHANGELOG
- Audit the
## [Unreleased]section against the commits in Phase 0: every user-facing change needs a bullet, and every bullet should trace to real code. If unsure, run thedocs-coherenceskill first — its report flags exactly the missing entries (this caught the bold/italic slash commands, theme-adaptive syntax colors, preview-scroll fix, and autocrlf fix missing from the v0.9.1 notes). - Rename
## [Unreleased]to## [<version>] - <YYYY-MM-DD>(today's date), and re-add an empty## [Unreleased]header at the top of the changelog (Keep a Changelog convention).
Phase 2 — version bump
- Root
Cargo.toml:[workspace.package] version = "X.Y.Z". - Root
Cargo.toml: the three[workspace.dependencies]shiki-core/shiki-config/shiki-tuiversion = "X.Y.Z"(plainsed -i 's/version = "OLD"/version = "NEW"/' Cargo.tomlcovers all four in one shot).Cargo.lockpicks them up on the nextcargo check. -
docs/index.html: the hardcoded JSON-LD"softwareVersion": "X.Y.Z"(the nav version pill and download button are fetched live; this one is not — bump by hand).
Phase 3 — docs site + config prose
- If a doc-audit found drift, fix the flagged files. Known hotspot from v0.9.1: the built-in
/-menu command count and list appear in four places and all must stay in sync —docs/documentation.html(the19 built-in commandsprose + the sample config block),IDEA.md(same two spots), andshiki-config/src/config.rs(section_commentfor[snippets]). Whenslash_menu.rs::builtins()changes, update all of them (and the count). - If
config.rsgained a[general]/other field, add it to that table'ssection_commentblock (a freshshiki configrun surfaces exactly which keys the prose omits).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 167 lines · 146 tokens per session scan C 447c10650918
deploy is a skill published in the GitHub repository sazardev/shiki (289 stars, last pushed 5d ago), licensed MIT. It adds 146 tokens to every session and 2,716 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kimun-cli
Use when the user has kimun installed and wants to create, append, search, or read notes from the terminal, or when automating note management as part of a workflow or agent task.
apple-notes
Manage Apple Notes via memo CLI: create, search, edit.
reflect-design
Use this skill to generate well-branded interfaces and assets for Reflect (reflect.app, the minimalist networked note-taking app), either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and UI kit components for prototyping.
wiki-sync
Synthesize a single source note into the vault's wiki/ folder — read the source, find or create the right wiki entry, write it back with proper frontmatter and source links. Used by Lumina's background wiki manager when a note changes.
release-version
Steps to cut a VNote version release (e.g. v4.3.0) — bump the version with scripts/updateversion.py, refresh and fill zhCN/ja translations via lupdate, write the changes.md changelog, and trigger the CI [Release] build. Use when asked to "release", "cut a release", "bump the version", or "prepare vX.Y.Z".
image-gen
Generate images for the user's vault — pick the right provider, gather reference images from notes when relevant, write the result to assets/generated/, and surface the markdown reference. Use this when the user asks for any picture, illustration, mood image, poster, or visual companion to a note.