Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/study8677/readme.skill/readme-skillnpx skills add study8677/Readme.skill --skill readme-skillgit clone --depth 1 https://github.com/study8677/Readme.skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00250 | $0.27812 |
| Opus 5 | $0.00125 | $0.13906 |
| Sonnet 5 | $0.00050 | $0.05562 |
| Haiku 4.5 | $0.00025 | $0.02781 |
Grade D, and why
readme-skill scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
head -1 ~/.claude/projects/<encoded>/*.jsonl 2>/dev/null \ Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
[ -f ~/.kiro/settings/mcp.json ] && cat ~/.kiro/settings/mcp.json | jq '.mcpServers | keys' Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
ls ~/.claude/skills/ | wc -l # skills installed / authored How it starts
The opening of the file, as written. The whole thing — 1,821 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Readme.skill — AI-Native 开发者档案生成器
You (the AI agent invoking this skill) will read local Claude Code + Codex CLI
- Kiro (AWS) + Trae (ByteDance) + Gemini Antigravity (Google) + Cursor data,
compute a fixed set of dimensions, and render both a Markdown profile and a
validated SVG poster under
./output/in the user's requested language (Chinese by default; English when the user asks in English or explicitly requests English). The profile and poster can cover the default history view or an explicit month / date range. You do all of the work — read the files withRead, query sqlite viaBash, synthesize the prose yourself, then write and validate the SVG. Do not write helper scripts; the skill is the recipe.
支持的 6 个 AI 编程工具(任一缺失都自动降级跳过):
- Claude Code (
~/.claude/) — Step 2- Codex CLI (
~/.codex/) — Step 3- Kiro CLI / IDE (
~/.kiro/+~/.local/share/kiro-cli/) — Step 3b- Trae IDE (
~/Library/Application Support/Trae/+ 项目.trae/) — Step 3c- Gemini Antigravity (
~/.gemini/antigravity/brain/) — Step 3d- Cursor (
~/Library/Application Support/Cursor/+ 项目.cursor/) — Step 3e
默认行为:对外分享版 —— 项目名匿名、敏感信息脱敏。 如果用户明确说"私人版 / 不要脱敏 / show real names",跳过匿名步骤。
Step 1 — 准备
cd <repo-with-this-skill> # e.g. ~/Projects/Readme.skill
mkdir -p output
DATE=$(date +%Y%m%d)
Decide anonymization mode (default = on). Build an in-memory mapping
real_path → "项目 A/B/C" as you encounter project paths in later steps.
Use the same mapping consistently across all sections.
1.1 时间窗口 / 月度报告模式
If the user asks for a month, quarter, stage, date range, "月度报告",
"按月份分析", "time range", "monthly report", or similar, set a report window
before reading any data. The window is a half-open local-date interval:
[REPORT_START, REPORT_END_EXCL).
Supported phrases:
- Single month:
2026-05,2026年5月,May 2026→REPORT_START=2026-05-01,REPORT_END_EXCL=2026-06-01,REPORT_LABEL=2026-05,REPORT_SLUG=202605,REPORT_MODE=monthly - Month range:
2026-04 到 2026-05,Apr-May 2026→ start at the first day of the first month, end at the first day after the last month,REPORT_MODE=range - Explicit dates:
2026-05-03 到 2026-05-19/2026-05-03..2026-05-19→ include both named dates by settingREPORT_END_EXCLto the day after the final date,REPORT_MODE=range - Relative range:
最近30天/last 30 days→ compute from today's local date,REPORT_MODE=range
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 1,821 lines · 250 tokens per session scan D badbf1cc35c7
readme-skill is a skill published in the GitHub repository study8677/Readme.skill (165 stars, last pushed 2mo ago), licensed MIT. It adds 250 tokens to every session and 27,812 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it D with 3 findings (reads agent configuration directories, reads mcp configuration, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bug-triage
Triage bugs reported in chat/issues, search for duplicates, file or update GitHub issues with full context, and push fix PRs.
using-ao
Catalog of the AO (Agent Orchestrator) ao CLI: spawning workers, managing sessions and projects, sending messages, controlling the shared browser, previewing pages, and daemon control. Use when using the ao CLI, spawning workers, or managing AO sessions in an AO workspace.
neo4j-cypher-skill
Generates, optimizes, and validates Cypher 25 queries for Neo4j 2025.x and 2026.x. Use when writing new Cypher queries, optimizing slow queries, graph pattern matching, vector or fulltext search, subqueries, or batch writes. Covers MATCH, MERGE, CREATE, WITH, RETURN, CALL, UNWIND, FOREACH, LOAD CSV, SEARCH…
neo4j-document-import-skill
Ingests unstructured and semi-structured documents into Neo4j as a knowledge graph. Use when chunking PDFs, HTML, plain text, or Markdown; extracting entities and relationships from text with an LLM (SimpleKGPipeline, neo4j-graphrag); loading JSON via apoc.load.json; building Document→Chunk→Entity graph structures; or…
neo4j-driver-dotnet-skill
Neo4j .NET Driver v6 — IDriver lifecycle, DI registration (singleton), ExecutableQuery fluent API, ExecuteReadAsync/ExecuteWriteAsync managed transactions, IResultCursor (FetchAsync/ ToListAsync), record value access (.Get /As ), null safety, UNWIND batching, temporal types, await using, EagerResult, object mapping…
neo4j-getting-started-skill
Orchestrates zero-to-running-app in 8 stages — prerequisites → context → provision → model → load → explore → query → build. Each stage reads its own reference file. Supports HITL and fully autonomous operation. Use when starting a new Neo4j project from scratch, provisioning Aura, generating synthetic data, building…