Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add soia-team/soia-open-skills --skill soia-meta-publish-marketgit clone --depth 1 https://github.com/soia-team/soia-open-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/soia-team/soia-open-skills/soia-meta-publish-market)<a href="https://agentmods.dev/skills/soia-team/soia-open-skills/soia-meta-publish-market"><img src="https://agentmods.dev/badge/skills/soia-team/soia-open-skills/soia-meta-publish-market/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/soia-team/soia-open-skills/soia-meta-publish-market"><img src="https://agentmods.dev/badge/skills/soia-team/soia-open-skills/soia-meta-publish-market.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.05906 |
| Opus 5 | $0.00036 | $0.02953 |
| Sonnet 5 | $0.00014 | $0.01181 |
| Haiku 4.5 | $0.00007 | $0.00591 |
Grade C, and why
soia-meta-publish-market scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
| R6 | 安全预检 | 硬缺口 | 包内含疑似凭据样式串（npm_/ghp_/xox 等前缀+长随机段）、以 `npm_` 开头的小写标识符（安全扫描按密钥前缀误报，云鼎 2026-08-08 实报 ai-cli-upgrade 健康度 47）、或 pipe-to-shell 命令字样（`curl … \| sh`） | 真凭据移除、占位符换明显假值；标识符更名避开前缀；安装建议改「下载→审阅→本地执行」表述 | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| R6 | 安全预检 | 硬缺口 | 包内含疑似凭据样式串（npm_/ghp_/xox 等前缀+长随机段）、以 `npm_` 开头的小写标识符（安全扫描按密钥前缀误报，云鼎 2026-08-08 实报 ai-cli-upgrade 健康度 47）、或 pipe-to-shell 命令字样（`curl … \| sh`） | 真凭据移除、占位符换明显假值；标识符更名避开前缀；安装建议改「下载→审阅→本地执行」表述 | How it starts
The opening of the file, as written. The whole thing — 371 lines — stays where its author put it; the contents beside it link to each section on GitHub.
soia-meta-publish-market
把已经正式发版的技能投递到外部市场。与插件市场（soia marketplace）不同，
外部市场一次只收一个技能，用户拿到的是孤立的一份——所以上架不是复制粘贴，
需要先筛选和改写。
执行前置：必须有客户当次的明确授权，且只上架已发版内容。 上架是对外动作，且外部平台一旦收录就有审核与展示记录，撤回成本高于插件市场。 客户说「改一下这个技能」不等于「上架它」。另外只投递
main上的正式版： dev 快照带-SNAPSHOT，上架等于把开发中状态发给陌生用户。--dry-run预检与--list-eligible盘点无需授权。
客户可读说明
这个技能可以做什么
| 客户想要 | 技能会做 | 客户能看到 |
|---|---|---|
| 看哪些技能能上架 | 扫全仓，按 hard 依赖筛选 | 逐技能的可否上架与原因 |
| 上架某个技能到 SkillHub | 打包 → 叠加平台字段 → --dry-run 预检 → 交客户提交 |
暂存路径、预检结果、待执行命令 |
| 发到小红书 Red Skill | 打包并给出上传指引 | 暂存路径与上传入口说明 |
| 更新已上架的技能 | 保持 slug 不变重新打包，提示填写变更说明 | 版本对比与 changelog 建议 |
| 上架前检查技能是否就绪 | 打包并对暂存产物跑 R1-R6 就绪门禁 | 逐项通过/警告/硬缺口报告，硬缺口拒绝打包 |
客户如何使用
# 1. 看这个仓哪些技能可以上架
python3 scripts/stage_for_market.py --repo-dir <域仓路径> --list-eligible
# 2. 打包某一个（不会上传；按渠道过滤文件）
python3 scripts/stage_for_market.py --repo-dir <域仓路径> \
--skill <技能名> --out <暂存目录> --channel skillhub|redskill \
--display-name "<中文展示名>"
# 3. 发版前咨询：对工作树跑一遍就绪门禁，不留产物（见「上架就绪门禁」）
python3 scripts/stage_for_market.py --repo-dir <域仓路径> \
--skill <技能名> --out <暂存目录> --allow-unreleased --check-only
打包内容直接从 origin/main 导出，不读工作副本——本地检出在哪个分支都不影响
结果，也就不会因为有人切走分支而误打包未发布内容（多 AI 共用检出时这是常态）。
main 上没有该技能、或 main 版本带 -SNAPSHOT，一律拒绝打包。
--channel redskill 时 --display-name 是必填，缺省直接拒跑，原因见
展示名与平台主键。
打包后由客户本人执行投递命令——见下方两个渠道。
依赖与安装
| 依赖 | 类型 | 缺失时怎么处理 |
|---|---|---|
| Python 3 | 强依赖 | 安装后重试 |
skillhub CLI |
SkillHub 渠道 | 见下方安装命令；未装则只做打包与预检说明 |
| SkillHub 实名认证 + API Token | SkillHub 渠道 | 未认证无法创建 Token，也无法发布；提示客户先完成 |
@xhs/skillhub-upload |
Red Skill 渠道（路径 A） | 未装则改走网页上传（路径 B），或提示客户先装 |
| 浏览器登录态 | Red Skill 渠道（路径 B） | 客户在小红书创作服务平台自行操作 |
两条硬规则（决定了本技能怎么筛选和改写）
装整个域（Claude Code 与 Codex 共用同一份域插件）：
claude plugin marketplace add soia-team/soia-open-skills
claude plugin install soia-meta@soia
只装这一个技能：
npx skills add soia-team/soia-open-skills -g -a '*' -s soia-meta-publish-market -y
WorkBuddy 的装载单位是角色化专家而不是插件，npx skills add -a '*' 覆盖不到它，需要单独安装，见 docs/install/workbuddy.md。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 371 lines · 72 tokens per session scan C c80253e226e6
soia-meta-publish-market is a skill published in the GitHub repository soia-team/soia-open-skills (5 stars, last pushed yesterday), licensed MIT. It adds 72 tokens to every session and 5,906 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
validate
Check that an Open Knowledge Format (OKF) bundle is conformant with the v0.2 spec (§11). Use when asked to validate, lint, or check an OKF bundle, or before committing changes to one. Runs a deterministic Python checker — not an eyeball pass. Also migrates a v0.1 bundle to v0.2 in place with --migrate.
memex-sync
Sync Zettelkasten cards across devices via git.
council
Multi-persona debate for founder decisions. 4 personas argue a topic across structured rounds.
raytsystem-watch
Inspect video, audio, or supplied transcripts through raytsystem Tool Hub and return evidence-bound speech, visual, OCR, action, transition, and timeline findings. Use for /watch, a YouTube/Loom/public Zoom/direct media URL, a local video or audio file, a transcript, or requests such as "watch this video", "analyze…
research-workflow-orchestrator
Run a resumable end-to-end research workflow that automates low-risk work, pauses at explicit human decision gates, records provenance, and routes each stage to the appropriate research-hub skill or MCP tool.
literature-triage-matrix
Turn a list of papers (Zotero collection, Obsidian cluster, manual list) into a compact comparison matrix written to .research/literaturematrix.md, instead of generic per-paper summaries. Use when the user asks to "make a literature matrix", "compare these papers by method/data/limitations", or "decide which papers…