Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Tencent-RTC/agent-skills --skill trtc-pushgit clone --depth 1 https://github.com/Tencent-RTC/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencent-rtc/agent-skills/trtc-push)<a href="https://agentmods.dev/skills/tencent-rtc/agent-skills/trtc-push"><img src="https://agentmods.dev/badge/skills/tencent-rtc/agent-skills/trtc-push/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tencent-rtc/agent-skills/trtc-push"><img src="https://agentmods.dev/badge/skills/tencent-rtc/agent-skills/trtc-push.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 96 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00165 | $0.01966 |
| Opus 5 | $0.00082 | $0.00983 |
| Sonnet 5 | $0.00033 | $0.00393 |
| Haiku 4.5 | $0.00016 | $0.00197 |
Grade A, and why
trtc-push scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TIMPush 开发者助手
渐进披露
- 每 turn 先读
issues/ROUTER.json做轻量路由;不要先读整个issues/。 - 进入 Android / iOS / Flutter / UniApp workflow 前,先读一次
references/hard-rules.md。 - 写 Gradle / Application / Podfile / AppDelegate /
registerPush代码前,再读references/timpush-sdk-api.md和references/code-templates.md。 - 路由命中非 workflow 知识时,只读命中的 1 个
target。 - 启动字段、
abandon_workflow等低频协议细节见references/workflow-protocol.md。
核心原则
本 Skill 不含可由 LLM 自行解释的流程正文。阶段、schema、失败路由都由 trtc-push-mcp 的 workflow engine 决定。
你的工作:按 engine 下发的当前 prompt 执行单步 → complete_workflow_step 提交结构化 output → 下一步只能来自引擎返回值。禁止自己编流程、跳步、或用 markdown 手册替代 engine。
每 turn(按顺序)
- 读
issues/ROUTER.json的match_any/priority/platform,得到候选target/workflow_id。路由是 best-effort;未命中不代表不能处理。 - 命中
platform=auto的集成入口(如“集成 push / 接入离线推送”)→ 先调用 detect 系列工具判断项目平台,再选择wizard-android/wizard-ios/wizard-flutter/wizard-uniapp。 - 命中 Android / iOS / Flutter / UniApp
workflow_id→ 读references/hard-rules.md,进入 Workflow 循环。 - 需要解释或非 workflow 知识 → 只读路由命中的 1 个
target。 - 无命中 → 按
fallback.question问 1 个澄清问题。 - 意图不清 →
list_workflows,把trigger_phrases复述给用户澄清。
特殊分支:
- 用户已明确是 Android / iOS TIMPush 排障但缺厂商/错误码 → 进对应
troubleshoot-*stage-0 收集症状与证据,不要自行下结论 list_workflows未返回预期 workflow → 提示用户重启 IDE / 确认trtc-push-mcpMCP 配置,不要退回 markdown 手册执行。
Workflow 循环
list_workflows(可选,看候选)
→ get_workflow_state(产品使用每 turn 带 user_prompt;调试不传)
→ 按返回的 prompt / required_tool_calls / completion_schema 执行
→ complete_workflow_step { run_id, step, output }(首选)
→ 按 status 继续或停止
run_id 是 workflow 主路径状态句柄;state_token 只作为兼容 / 跨进程快照。后续
get_workflow_state、complete_workflow_step、abandon_workflow 都优先传
上一轮返回的 run_id。state_token 必须视为 opaque:禁止手改、拼接、解码后重组、
局部复制;如果只剩 state_token,只能原样回传。
产品工作流 MCP(不是 Skill 体验数据上报)
trtc-push-mcp 是 TIMPush 的功能型工作流 MCP,用于推进产品配置状态;它不是体验数据上报 MCP,也不替代 Root/Host 的 Prompt → invoke → Host Stop 链路。
- 产品使用时,每轮向
get_workflow_state传user_prompt;工具调试或无法判断时不传,质量事件和本地脱敏由 MCP 统一处理。 - 不得把
user_prompt放入context,也不得执行--prompt-stdin/--log-stdin;避免原文进入state_token或额外 shell 链路。
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- issues/cards/android/fcm-gms-domestic.md 2.4 KB
- issues/cards/android/vendor-huawei.md 3.4 KB
- issues/cards/common/console-certificate-quota.md 1.9 KB
- issues/cards/common/registration-binding.md 3.1 KB
- issues/cards/ios/aps-environment-3000.md 1.7 KB
- issues/cards/ios/certificate-businessid.md 2.8 KB
- issues/cards/ios/xcodegen-cocoapods-module.md 2.2 KB
- issues/flows/android/delivered-not-displayed.md 2.4 KB
- issues/flows/android/vendor-not-received.md 2.7 KB
- issues/flows/common/badge.md 2.1 KB
- issues/flows/common/console-product-limits.md 2.1 KB
- issues/flows/common/server-api.md 2.4 KB
- issues/flows/cross-platform/harmonyos.md 2.5 KB
- issues/flows/cross-platform/uniapp-integration.md 2.5 KB
- issues/flows/ios/offline-not-received.md 2.7 KB
- issues/ROUTER.json 11 KB
- references/code-templates.md 12 KB
- references/hard-rules.md 10 KB
- references/timpush-sdk-api.md 3.5 KB
- references/workflow-protocol.md 2.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -1 lines · -103 tokens per session 3528fd9ea941
- 9d ago First seen · 113 lines · 268 tokens per session scan A e6d5ac2685f4
trtc-push is a skill published in the GitHub repository Tencent-RTC/agent-skills (12 stars, last pushed 5d ago), licensed MIT. It adds 165 tokens to every session and 1,966 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
stream-flutter
Build and integrate Stream Chat, Video, and Feeds in Flutter apps. Use for Flutter/Dart project work with Stream package setup, auth wiring, and widget blueprints. Supports streamchatflutter (pre-built Chat UI), streamchatfluttercore (custom Chat UI), streamvideoflutter (Video calling and livestreaming), and…
cometchat-ios-calls
CometChat Calls SDK v5 integration for native iOS (Swift; SwiftUI + UIKit hosting). Covers SDK install (SPM + CocoaPods), file-based init via cometchat-settings.json (CometChatCalls.initFromSettings, ai-agent telemetry) with builder fallback, dual-SDK ringing (Chat SDK initiateCall + Calls SDK…
cometchat-flutter-v6-events
Use when working with real-time events, SDK listeners, or UI event streams in CometChat Flutter UIKit v6. Triggers on mentions of CometChatMessageEvents, CometChatUserEvents, CometChatGroupEvents, CometChatCallEvents, CometChatConversationEvents, MessageListener, UserListener, GroupListener, CallListener…
cometchat-native-production
Production-readiness for React Native — server-minted auth tokens, user management CRUD, external-backend recipes (Express / Hono / Firebase Functions / Vercel Serverless). RN has no API routes, so the backend is always external.
build-zoom-contact-center-app
Reference skill for Zoom Contact Center. Use after routing to a contact-center workflow when implementing app, web, or native integrations; engagement context and state handling; campaigns; callbacks; or version-drift troubleshooting.
add-signal
Add Signal channel integration via signal-cli device-link. Native adapter — no Chat SDK bridge.