A workflow for Zhihu Yunxiao, an internal system used to create, inspect, test, and approve merge requests, which are requests to merge code changes.

Use it to create first-time merge requests, list open or unmerged requests, run quality checks, approve requests in batches, or manage the approval daemon and dashboard.

It provides defined procedures for reading merge-request status, quality checks, bulk approvals, and a macOS approval service while protecting access tokens.

yunxiao — Skill for Claude Code by SSBun

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add SSBun/csl-agent-kit --skill yunxiao

Clone the repo

git clone --depth 1 https://github.com/SSBun/csl-agent-kit

Made for: Claude Code.

Or install csl, the plugin that ships this one along with the rest of its 34 skills, 2 commands, 1 agent, 10 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/ssbun/csl-agent-kit/yunxiao.svg)](https://agentmods.dev/skills/ssbun/csl-agent-kit/yunxiao)

Your own site

<a href="https://agentmods.dev/skills/ssbun/csl-agent-kit/yunxiao"><img src="https://agentmods.dev/badge/skills/ssbun/csl-agent-kit/yunxiao.svg" alt="Measured on agentmods" height="20"></a>

Per session 77 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 944 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00077	$0.00944
Opus 5	$0.00039	$0.00472
Sonnet 5	$0.00015	$0.00189
Haiku 4.5	$0.00008	$0.00094

Measured 8d ago against content hash 80f098feeacb, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade B, and why

yunxiao scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/yunxiao.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

2. Build a schema-compliant manifest. For temporary files, use `mktemp`, run `chmod 600`, then delete them. Do not rewrite user-supplied manifests.

skills/domain/yunxiao/SKILL.md · 67 lines

How it starts

The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Yunxiao

Prerequisites

Require Node.js 18+, Git, classic-level, mqtt, and either YUNXIAO_TOKEN or Chrome/Chromium logged in to one.in.zhihu.com. Daemon needs terminal-notifier on PATH for clickable notifications.
Prefer the environment variable. Otherwise the script copies Chrome Local Storage LevelDB to a temporary directory, reads the exact one.in.zhihu.com/token record, and validates candidates with a One GET. Never request a token in chat, command arguments, a manifest, or logs.
Read references/manifest-schema.md and collect explicit inputs under that contract. Never read or invoke zspec, and never use zspec.json as runtime input.

Read-Only Queries

node <skill-dir>/scripts/yunxiao.mjs list-unmerged --from <YYYY-MM-DD> --to <YYYY-MM-DD>
node <skill-dir>/scripts/yunxiao.mjs list-qa --repo <namespace/repository>

Both are GET-only; list-qa returns the repository's zero or one configured qaOwner plus qaRequired.

Bulk Approval Workflow

Follow references/approval-workflow.md; approve-all requires explicit confirmation of the exact planId from plan-approvals.

Auto-Approval Daemon

Follow references/daemon-workflow.md. Confirm unattended approval of every eligible request before daemon install --yes or daemon start --yes. It is macOS-only, never merges, and exposes a read-only loopback Dashboard.

Creation Workflow

Confirm each module's Git root, source and target branches, target repository, and push remote. Ask for missing targets; do not guess.
Build a schema-compliant manifest. For temporary files, use mktemp, run chmod 600, then delete them. Do not rewrite user-supplied manifests.

Run the read-only plan:

node <skill-dir>/scripts/yunxiao.mjs plan --input <manifest.json>

Show branches, remotes, repositories, work item, QA, MR form, and warnings. State that execution pushes branches and creates remote MRs.
After explicit confirmation for this execution, run:

Read the full file on GitHub · 67 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 67 lines · 77 tokens per session scan B 80f098feeacb

Subscribe to this mod's changes

yunxiao is a skill published in the GitHub repository SSBun/csl-agent-kit (10 stars, last pushed 7d ago), licensed MIT. It adds 77 tokens to every session and 944 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflow

prowler-commit

Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.

prowler-cloud/prowler · 33 tokens

gh-auth-isolation

Safely manage multiple GitHub identities (EMU + personal) in agent workflows.

github/gh-aw · 20 tokens

comet-github

A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.

rpamis/comet · 72 tokens

github-skill

Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.

zeenie-ai/OpenCompany · 51 tokens

re0-merge

Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…

LilMGenius/paperthin · 70 tokens

codex-autoresearch

Run autonomous, measurable experiments in a Git repository: change one hypothesis, verify a numeric metric, keep improvements, and revert failures. Use when the user wants Codex to keep iterating toward a numeric target in the foreground or as a detached background run. Do not use for ordinary one-shot coding…

leo-lilinxiao/codex-autoresearch · 80 tokens

yunxiao