Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sourcelin/sourcelin-cloud-blog/frontend-uniapp-devnpx skills add SourceLin/sourcelin-cloud-blog --skill frontend-uniapp-devgit clone --depth 1 https://github.com/SourceLin/sourcelin-cloud-blogWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.00906 |
| Opus 5 | $0.00019 | $0.00453 |
| Sonnet 5 | $0.00008 | $0.00181 |
| Haiku 4.5 | $0.00004 | $0.00091 |
Grade A, and why
frontend-uniapp-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Uniapp 移动端开发技能
使用场景
- 修改 sourcelin-ui/sourcelin-ui-uniapp。
- 新增或调整微信小程序页面、Tab、分包、静态资源或构建配置。
- 涉及能力开关(useMiniAccess、capabilityStore、MobileCapabilities)的功能可见性控制。
- 涉及自定义液态 TabBar(liquid-tabbar.ts)的 Tab 配置与切换逻辑。
- 接入移动端前台 API、登录态、用户信息、分页列表和互动能力。
- 落地 Liquid Glass Mobile 视觉规范、移动端交互和跨端兼容处理。
输入
- 需求说明或待修改文件。
- 当前 src/pages.json、src/config/env.ts、请求层、store 和业务模块实现。
- 相关后端接口契约与产品设计文档。
输出
- 符合 Uniapp 目录边界和小程序限制的代码改动。
- 明确的 API 类型、页面状态和交互反馈。
- 已执行验证命令和结果。
执行步骤
- 读取仓库根 AGENTS.md、 ules/frontend-uniapp.md、 ules/api-contract.md、 ules/coding-conventions.md、 ules/testing-and-validation.md。
- 读取 sourcelin-ui/sourcelin-ui-uniapp/AGENTS.md。
- 定位改动属于页面、模块 API、composable、store、组件、静态资源、pages.json、manifest.json 或环境配置。
- 涉及 API 时先确认路径属于 /blog-api 前台域;移动端登录使用 loginType=mini。
- 页面请求必须经过 src/utils/request.ts,复杂请求、分页、筛选和提交逻辑优先下沉到 src/modules/**/composables。
- 新增页面同步维护 src/pages.json;新增 Tab 同步维护图标、文本和页面路径。
- 小程序端优先验证,避免使用浏览器专有 API;平台差异使用 Uniapp 条件编译。
- 样式使用 src/styles/** token 和自定义 s-* 组件体系,避免照搬 Web 前台布局。
- 修改后执行 pm run lint 和 pm run type-check;涉及页面、路由、Tab、manifest、静态资源或小程序兼容时执行 pm run build:mp-weixin;涉及 H5 时追加 pm run build:h5。
- 涉及功能可见性时使用 useMiniAccess().can() 判断能力开关,能力定义来自 src/shared/api/capability.api.ts 的 MobileCapabilities 接口,由 capabilityStore 在应用启动时从 /front/mobile/capabilities 拉取。
- 涉及底部导航时注意区分原生 TabBar(首页、发现、我的,共 3 个)和液态 TabBar(4 个,含圈子)。圈子页通过 avigateTo 跳转而非 switchTab,液态 TabBar 配置在 src/shared/utils/liquid-tabbar.ts。
依赖 rules
ules/frontend-uniapp.md
ules/api-contract.md
ules/coding-conventions.md
ules/testing-and-validation.md
禁止行为
- 禁止页面或 composable 直接调用 uni.request。
- 禁止移动端调用 /prod-api/、/system/、/blog/admin/** 等后台管理域接口。
- 禁止移动端登录继续复用 Web 前台 loginType=blog。
- 禁止新增 ny、旧分页字段或旧响应字段 fallback。
- 禁止使用 Vue Router、window、document、localStorage 等浏览器专有能力。
- 禁止配置不存在的 subPackages[].root。
- 禁止引入重型 UI 框架替代现有自定义组件体系。
- 禁止在未通过 useMiniAccess().can() 检查的情况下直接展示需要能力开关控制的功能入口。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 64 lines · 38 tokens per session scan A 72b99737302e
frontend-uniapp-dev is a skill published in the GitHub repository SourceLin/sourcelin-cloud-blog (20 stars, last pushed 2mo ago), licensed MIT. It adds 38 tokens to every session and 906 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
orca-emulator-android
Control an Android emulator / device from inside Orca using the orca CLI. Use for listing/booting AVDs, taps, swipes, typing, hardware buttons (incl. Back and Recents), rotation, app install/launch, runtime permissions, the accessibility tree, and logcat — driving a real adb-connected device or emulator.…
android-tombstone-symbolication
Symbolicate the .NET runtime frames in an Android tombstone file. Extracts BuildIds and PC offsets from the native backtrace, downloads debug symbols from the Microsoft symbol server, and runs llvm-symbolizer to produce function names with source file and line numbers. USE FOR triaging a .NET MAUI or Mono Android app…
git-safety
Git safety rules. INVOKE WHEN: git push, force push, git reset, git clean, destructive git, push force, reset hard. NEVER force push or do destructive git operations.
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.
release
Cut a sim-use release end-to-end. Use when the user runs /release or asks to "ship a release", "publish a version", "cut a release", or "release to homebrew". Drives scripts/local-release.sh; never reimplement its build/sign/tarball logic.
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析.