Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Tencent-RTC/agent-skills --skill trtc-pushgit clone --depth 1 https://github.com/Tencent-RTC/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencent-rtc/agent-skills/trtc-push)<a href="https://agentmods.dev/skills/tencent-rtc/agent-skills/trtc-push"><img src="https://agentmods.dev/badge/skills/tencent-rtc/agent-skills/trtc-push/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tencent-rtc/agent-skills/trtc-push"><img src="https://agentmods.dev/badge/skills/tencent-rtc/agent-skills/trtc-push.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 96 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00165 | $0.02934 |
| Opus 5.5 | $0.00066 | $0.01174 |
| Sonnet 5.5 | $0.00033 | $0.00587 |
| Haiku 4.5 | $0.00016 | $0.00293 |
Grade A, and why
trtc-push scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TIMPush 开发者助手
渐进披露
- 每 turn 先读
issues/ROUTER.json做轻量路由;不要先读整个issues/。 - 进入 Android / iOS / Flutter / UniApp / HarmonyOS workflow 前,先读一次
references/hard-rules.md。 - 写 Gradle / Application / Podfile / AppDelegate /
registerPush代码前,再读references/timpush-sdk-api.md和references/code-templates.md。 - wizard 走到 stage-8 / stage-10 结尾输出「后台 API 能力衔接段」,或 stage-11 落到
unavailable分支(用户没配管理员凭据)时,读一次references/push-server-onboarding.md——它是能力清单 + 可复制 mcp.json snippet + UserSig 获取步骤的唯一权威副本,禁止自由发挥。 - 路由命中非 workflow 知识时,只读命中的 1 个
target。 - 启动字段、
abandon_workflow等低频协议细节见references/workflow-protocol.md。
核心原则
本 Skill 不含可由 LLM 自行解释的流程正文。阶段、schema、失败路由都由 trtc-push-mcp 的 workflow engine 决定。
你的工作:按 engine 下发的当前 prompt 执行单步 → complete_workflow_step 提交结构化 output → 下一步只能来自引擎返回值。禁止自己编流程、跳步、或用 markdown 手册替代 engine。
外部流程 skill 不能替代 wizard 任一阶段;即使用户要求用外部方案驱动集成,凭据、路径、注册时序等红线仍以 engine 下发的 prompt 与 schema 为准。
排障写文件与逐步引导(硬)
troubleshoot-*默认零写入:未获用户本轮明确授权前,禁止改用户工程任何文件。可疑 bug → 贴拟改 diff + 问是否授权;详见references/hard-rules.md「Troubleshoot:零写入 + 逐步引导」。- 本轮最多 1~2 个用户问题 / 1 个校验动作;禁止一股脑丢长 checklist。每个问题写清:怎么做、期望看到什么、做完回什么。
- 禁止把 AtomicX
LoginStore.setCertificateID当成 TIMPushregisterPush的替代(见cards/ios/atomicx-vs-timpush.md)。
每 turn(按顺序)
- 读
issues/ROUTER.json的match_any/priority/platform,得到候选target/workflow_id。路由是 best-effort;未命中不代表不能处理。 - 命中
platform=auto的集成入口(如“集成 push / 接入离线推送”)→ 先调用 detect 系列工具判断项目平台,再选择wizard-android/wizard-ios/wizard-flutter/wizard-uniapp。 - 命中 Android / iOS / Flutter / UniApp
workflow_id→ 读references/hard-rules.md,进入 Workflow 循环。 - 需要解释或非 workflow 知识 → 只读路由命中的 1 个
target。 - 无命中 → 按
fallback.question问 1 个澄清问题。 - 意图不清 →
list_workflows,把trigger_phrases复述给用户澄清。
特殊分支:
- 用户已明确是 Android / iOS TIMPush 排障但缺厂商/错误码 → 进对应
troubleshoot-*stage-0 收集症状与证据,不要自行下结论;stage-0 先问 1 个澄清/校验问题并等待用户回复,不要跳过引擎直接改源码或一次抛出全部排查项 list_workflows未返回预期 workflow 或trtc-push-mcp工具整体不可用 → 按「MCP 不可用(硬停止)」提醒用户开启并等待,不要退回 markdown 手册执行、不要静默兜底。
What ships with it
40 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- issues/cards/android/error-codes.md 6.3 KB
- issues/cards/android/fcm-gms-domestic.md 3.0 KB
- issues/cards/android/kill-process-offline.md 2.4 KB
- issues/cards/android/message-category-limit.md 2.5 KB
- issues/cards/android/notification-click-jump.md 1.9 KB
- issues/cards/android/oppo-channel-display.md 2.5 KB
- issues/cards/android/proguard-release-stats.md 1.5 KB
- issues/cards/android/vendor-huawei.md 4.2 KB
- issues/cards/android/xiaomi-vivo-store-channel.md 2.2 KB
- issues/cards/common/console-certificate-quota.md 2.2 KB
- issues/cards/common/console-validity-gate.md 2.7 KB
- issues/cards/common/registration-binding.md 3.4 KB
- issues/cards/common/timpush-only-registrationid.md 1.7 KB
- issues/cards/harmonyos/click-ohmurl-crash.md 1.7 KB
- issues/cards/ios/aps-environment-3000.md 2.0 KB
- issues/cards/ios/atomicx-vs-timpush.md 3.3 KB
- issues/cards/ios/certificate-businessid.md 3.4 KB
- issues/cards/ios/device-token-binding.md 2.2 KB
- issues/cards/ios/notification-click-ext.md 3.1 KB
- issues/cards/ios/p8-invalid-provider-token.md 1.8 KB
- issues/cards/ios/stats-extension.md 1.8 KB
- issues/cards/ios/xcodegen-cocoapods-module.md 2.5 KB
- issues/flows/android/click-no-action.md 2.3 KB
- issues/flows/android/delivered-not-displayed.md 3.8 KB
- issues/flows/android/offline-not-received.md 4.5 KB
- issues/flows/android/register-failed.md 4.4 KB
- issues/flows/android/vendor-not-received.md 3.7 KB
- issues/flows/common/badge.md 2.5 KB
- issues/flows/common/console-product-limits.md 3.0 KB
- issues/flows/common/server-api.md 2.7 KB
- issues/flows/cross-platform/flutter-push-troubleshoot.md 2.3 KB
- issues/flows/cross-platform/uniapp-integration.md 2.3 KB
- issues/flows/harmonyos/offline-not-received.md 4.0 KB
- issues/flows/ios/offline-not-received.md 5.1 KB
- issues/ROUTER.json 20 KB
- references/code-templates.md 13 KB
- references/hard-rules.md 21 KB
- references/push-server-onboarding.md 7.8 KB
- references/timpush-sdk-api.md 3.5 KB
- references/workflow-protocol.md 3.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 1f9c61393058
- 1mo ago Changed · +26 lines ec6053ba68c2
- 1mo ago Changed 83963df78065
- 1mo ago Changed · -1 lines · -103 tokens per session 3528fd9ea941
- 1mo ago First seen · 113 lines · 268 tokens per session scan A e6d5ac2685f4
trtc-push is a skill published in the GitHub repository Tencent-RTC/agent-skills (15 stars, last pushed 4d ago), licensed MIT. It adds 165 tokens to every session and 2,934 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cometchat-ios-calls
Add voice and video calling to an iOS CometChat app — call buttons, incoming/ongoing call screens, call logs, and CallKit ringing. Triggers: 'add video calling ios', 'cometchat voice call swift', 'incoming call screen ios', 'call logs cometchat ios'.
cometchat-flutter-v6-events
React to CometChat activity in a Flutter app — SDK listeners (messages, calls, users, groups, connection) versus UI Kit events (CometChatMessageEvents, CometChatGroupEvents, CometChatUserEvents, CometChatConversationEvents), and the listener lifecycle that keeps them from leaking. Triggers: 'listen for new messages'…
stream-flutter
Build and integrate Stream Chat, Video, and Feeds in Flutter apps. Use for Flutter/Dart project work with Stream package setup, auth wiring, and widget blueprints. Supports streamchatflutter (pre-built Chat UI), streamchatfluttercore (custom Chat UI), streamvideoflutter (Video calling and livestreaming), and…
build-zoom-contact-center-app
Reference skill for Zoom Contact Center. Use after routing to a contact-center workflow when implementing app, web, or native integrations; engagement context and state handling; campaigns; callbacks; or version-drift troubleshooting.
add-signal
Add Signal channel integration via signal-cli device-link. Native adapter — no Chat SDK bridge.
build-zoom-meeting-app
Build or embed a Zoom meeting flow. Use when implementing Meeting SDK joins, web or mobile meeting embeds, meeting lifecycle flows, or when deciding between Meeting SDK and Video SDK.