Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add starcat-app/Starcat --skill starcat-weekly-importgit clone --depth 1 https://github.com/starcat-app/StarcatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starcat-app/starcat/starcat-weekly-import)<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-weekly-import"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-weekly-import/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-weekly-import"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-weekly-import.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 3 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 70 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00153 | $0.01840 |
| Opus 5.5 | $0.00061 | $0.00736 |
| Sonnet 5.5 | $0.00031 | $0.00368 |
| Haiku 4.5 | $0.00015 | $0.00184 |
Grade A, and why
starcat-weekly-import scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Starcat Weekly 情报采集
把非结构化文本转换为经核验的 GitHub owner/repo 列表,并在用户确认后一次性提交。当前默认分类是 ai_intelligence;分类必须来自服务端允许人工录入的固定来源目录,禁止自行创造分类。
硬性边界
- 先解析、搜索、核验和展示候选,得到用户明确确认后才能调用写接口。
- 写入前调用
GET /internal/sources?manual_import=true,只使用响应中enabled=true且manual_import_enabled=true的来源。 - 未指定分类时使用
ai_intelligence。如果用户指定的分类不在允许列表中,停止提交并解释原因。 - 只提交确定为 GitHub 仓库的
owner/repo;组织主页、用户主页、GitHub Topics、Issue、Release、文件路径和搜索页都不是仓库。 - 新闻标题是检索线索,不是仓库名:对于没有显式 GitHub URL 的每一条输入,必须联网定位发布主体和实际项目;不要要求用户自行补链接,也不要按标题字面猜测仓库。
- 仅提交与新闻主体直接对应的官方仓库。若新闻是闭源产品、云服务、论文、仅在 Hugging Face/Civitai 发布的模型或硬件发布,而没有该主体的官方 GitHub 仓库,记为“未找到”;不得用同名第三方实现、上游项目、配套节点或辅助工具替代。
- 一个输入批次最多提交 200 个仓库。批内按小写
owner/repo去重,但保留用户原文标题和来源链接。 - 用户未明确说明“测试”时,一律固定使用生产服务
https://starcat-api.fly.dev,并通过X-SC-Svc: weekly路由到 Weekly,不得接受或推断其他 Base URL。 - 生产 Admin Key 只从
supports/starcat-api/.env的WEEKLY_ADMIN_API_KEYS读取;多值时使用第一个非空 Key。不得要求用户导出生产 Key,也不得在 Skill、命令或输出中显示 Key。 - 只有用户明确说明“测试”时才使用
--test,此时才允许通过--base-url/STARCAT_WEEKLY_BASE_URL和STARCAT_WEEKLY_ADMIN_KEY注入测试配置。 - POST 只代表持久化入队成功,不代表 GitHub 数据已补全;拿到
batch_id后必须轮询批次终态。
工作流
1. 提取显式仓库
从文本中优先提取:
https://github.com/{owner}/{repo};github.com/{owner}/{repo};- 独立出现且上下文明确的
{owner}/{repo}。
规范化时移除 .git、结尾 /、query、fragment,以及仓库后面的 /issues、/releases、/tree/... 等路径,只保留前两个 path segment。
2. 联网甄别新闻并搜索缺失地址
把没有显式 GitHub URL 的条目视为新闻线索,逐条联网检索。先确认新闻提及的是开源项目、产品/服务、论文、模型还是硬件,再定位其发布方及实际项目;不要假设新闻标题与仓库名相同。搜索式优先使用:
"项目名" GitHub
"项目名" 官方 GitHub
"公司名" "项目名" GitHub
优先级依次为官方组织仓库、项目官网链接的 GitHub、维护者公开仓库。名称相似但证据不足时标记为“待确认”,不要猜测并提交。
3. 核验真实性
每个候选至少检查:
- GitHub 仓库页面真实存在,且 canonical 地址与候选一致;
- 仓库 README、描述、官网或发布者与输入文本指向同一项目;
- 不是 fork 冒充上游、镜像、占位仓库或同名无关项目;
- 仓库与新闻主体直接对应;新闻仅提及模型权重、论文、云服务或产品时,不得以同作者的配套节点、示例、上游或第三方实现替代。
- 新闻描述的是闭源产品、论文或模型但没有官方 GitHub 仓库时,明确记为“未找到”,不要用第三方实现代替。
4. 展示并请求确认
提交前给出紧凑表格:原始条目、规范化 owner/repo、GitHub URL、核验结论、依据。把“已确认”“待确认”“未找到”分开;只把“已确认”加入拟提交列表。
明确询问用户是否提交该列表到指定来源。用户修改列表后重新展示最终集合;不得把之前被排除的候选带回。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed f21904bfee6e
- 2mo ago Changed · +1 lines · -4 tokens per session 7cae04dff4a6
- 2mo ago First seen · 111 lines · 157 tokens per session scan A f4f22b7372fc
starcat-weekly-import is a skill published in the GitHub repository starcat-app/Starcat (215 stars, last pushed yesterday), licensed MIT. It adds 153 tokens to every session and 1,840 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
starcat-weekly-import compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| starcat-weekly-importstarcat-app/Starcat | Skill | 215 | yesterday | MIT | A | 153 | Codex |
| wegent-knowledgewecode-ai/Wegent | Skill | 882 | yesterday | Apache-2.0 | A | 60 | Claude Code, Codex |
| binder-appmpazik/Binder | Skill | 40 | 17d ago | MIT | A | 74 | Claude Code, Codex |
| my-wikiNimaChu/my-wiki | Skill | 127 | 22d ago | MIT | A | 51 | Codex |
| memobasemaximskorohod/memobase | Skill | 22 | 17d ago | MIT | A | 25 | Claude Code, Codex |
| s-gwsgateway/s-gw | Skill | 15 | 5d ago | Apache-2.0 | A | 51 | Claude Code, Codex |
| chromadb-managerdem2007/ChromaDB-Manager | Skill | 2 | 10d ago | MPL-2.0 | A | 15 | Claude Code, Codex |