Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/TashanGKD/tashan-cursor-skillsnpx agentmods add skills/tashangkd/tashan-cursor-skills/tashan-workbench-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tashangkd/tashan-cursor-skills/tashan-workbench-dev)<a href="https://agentmods.dev/skills/tashangkd/tashan-cursor-skills/tashan-workbench-dev"><img src="https://agentmods.dev/badge/skills/tashangkd/tashan-cursor-skills/tashan-workbench-dev/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tashangkd/tashan-cursor-skills/tashan-workbench-dev"><img src="https://agentmods.dev/badge/skills/tashangkd/tashan-cursor-skills/tashan-workbench-dev.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02803 |
| Opus 5 | $0.00044 | $0.01401 |
| Sonnet 5 | $0.00018 | $0.00561 |
| Haiku 4.5 | $0.00009 | $0.00280 |
Grade A, and why
tashan-workbench-dev scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl http://127.0.0.1:4897/health How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
他山工作台 · 开发 Skill
他山工作台（tashan-workbench）是基于 OpenWork fork 的本地 AI 桌面应用，内嵌 opencode 执行引擎，搭载 Tashan Cognitive Pack 认知内核。 代码位置：
项目群/tashan-workbench/
激活后立即执行
Step 1 Read: 项目群/openwork-local/产品经理/产品定义.md（v0.7）→ 了解产品边界
Step 2 Read: 项目群/openwork-local/技术架构师/技术架构_v0.2_正式版.md → 架构契约
Step 3 Read: 项目群/tashan-workbench/DEPLOY_ARCH.md → 部署状态和端口信息
Step 4 本次任务的具体需求 → 按「五类测试维度」执行
核心架构速查
tashan-workbench/（monorepo）
├── packages/app/ ← 前端（React 18 + Tailwind + Noto Serif SC）
│ └── src/
│ ├── App.tsx ← 三栏布局（左:对话 / 中:预览 / 右:搜索+记忆）
│ ├── api/client.ts ← openwork-server API 封装（含4优先级 token 解析）
│ └── types/ ← 共享类型
│
├── packages/server/ ← openwork-server（Bun TypeScript，端口 4897）
│ └── src/
│ ├── server.ts ← 所有 API 路由（含 /brain/* /workspace/:id/search）
│ ├── workspace-search.ts ← BM25 全文检索（16单测）
│ └── brain-bridge.ts ← 他山Brain HTTP 封装（17单测）
│
├── packages/tashan-mcp/ ← tashan-mcp MCP 服务器（stdio）
│ └── src/
│ ├── server.ts ← brain_ask / spawn_task / list_tasks / cancel_task
│ ├── task-manager.ts ← 子任务生命周期（支持 SQLite 持久化）
│ └── task-store.ts ← SQLite 持久化层（7单测）
│
├── packages/desktop/ ← Tauri 桌面应用壳层（Rust）
│ └── src-tauri/
│ └── sidecars/ ← 预编译 opencode/openwork-server/mcp 二进制
│
├── opencode.json ← AI 模型配置（DashScope + tashan-mcp 注册）
└── .opencode/skills/ ← Tashan Cognitive Pack（系统提示词注入）
├── tashan-cognitive-pack/SKILL.md ← 认知工作流
└── tashan-brand-guard/SKILL.md ← 前端品牌规范
本地开发启动（推荐：不打包直接验证）
# 终端1：启动 AI 执行引擎（opencode）
# （通常已在后台，检查：lsof -i:4900）
# 终端2：启动 openwork-server
export PATH="$HOME/.bun/bin:$PATH"
cd 项目群/tashan-workbench/packages/server
bun src/cli.ts \
--workspace ~/aiwork/0310_huaxiang/项目群/tashan-workbench \
--opencode-base-url http://127.0.0.1:4900 \
--port 4897
# ⚠️ 记录输出的 Client token，每次重启都会变
# 终端3：更新前端 token 并启动 Vite
TOKEN="从终端2复制"
echo "VITE_OPENWORK_URL=http://127.0.0.1:4897
VITE_OPENWORK_TOKEN=$TOKEN" > packages/app/.env
cd packages/app && pnpm exec vite --port 5200
# 浏览器打开 http://localhost:5200
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 228 lines · 88 tokens per session scan A ba2807c65abe
tashan-workbench-dev is a skill published in the GitHub repository TashanGKD/tashan-cursor-skills (20 stars, last pushed 5mo ago), licensed MIT. It adds 88 tokens to every session and 2,803 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
incident-learning
Convert operational incident and near-miss evidence into durable product, engineering, test, evaluation, and governance improvements with verified closure. Separate observed facts from causal hypotheses and unresolved uncertainty; map follow-up work across code, tests, skills, operations, product, and governance…
plan-dead-code
Configuration-first dead-code audit — Knip baseline for unused files, exports and deps, plus duplication, debug residue, suppression debt, orphan assets, env and schema drift. Emits a ratchet plan; deletes nothing. Use when "find dead code", "is this code used", "unused exports". Apply → housekeep-dead-code.
sentry-triage-to-pr
Triage unresolved Sentry issues into ranked groups, GitHub issue plans, branches, subspawn worktree assignments, PRs, and closeout loops using the sentry CLI, GitHub CLI, and local verification. Use when asked to prioritize Sentry backlogs, group production issues, create GitHub issues or PRs from Sentry evidence, or…
analyze
Deep codebase analysis — complexity, coupling, dead code, tech debt hotspots.
explore
Read-only codebase exploration — understand structure, data flow, and conventions before changing anything.
incident
Production incident response — structured triage, hypothesis tree, safe remediation, incident record.