Octop is a self-hosted, multi-user AI assistant that runs multiple specialized agents and connects them to chat interfaces, tools, and external services. It is for individuals, families, and teams who want a locally operated assistant with shared experts and persistent capabilities. Catalogue add-ons extend its agent and assistant workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TencentCloud/Octop --skill bo-risk-assessmentgit clone --depth 1 https://github.com/TencentCloud/OctopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencentcloud/octop/bo-risk-assessment)<a href="https://agentmods.dev/skills/tencentcloud/octop/bo-risk-assessment"><img src="https://agentmods.dev/badge/skills/tencentcloud/octop/bo-risk-assessment/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tencentcloud/octop/bo-risk-assessment"><img src="https://agentmods.dev/badge/skills/tencentcloud/octop/bo-risk-assessment.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00612 |
| Opus 5.5 | $0.00017 | $0.00245 |
| Sonnet 5.5 | $0.00009 | $0.00122 |
| Haiku 4.5 | $0.00004 | $0.00061 |
Grade A, and why
bo-risk-assessment scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
运营风险评估
每项写“给定现象；触发条件下的潜在后果；建议措施”，用中性标题。只选有独立机制或应对价值的风险，上限不必填满。短稿不设空定级、整改或缺口章节。
先按已给风险事实选条目，再写措施；未知的控制或记录情况只作为对应条目的核实点，不单独凑成一项风险。标题优先命名材料支持的业务后果，如“班次空岗”，不要写“缺少记录”“无替补”等未经确认的现状。
若多项风险使用同一项班前核对、状态确认等控制措施，将措施合并写一次；只有触发机制或应对方式确有差异时才拆成多项，避免换一种说法重复安排同一检查。
事实与后果
现象保留原主语、数量、程度，不增加人数、独占依赖或发生频度。可能后果保持可能性，即使用户要求肯定措辞也不能改成必然。
例（虚构）：“两次交接记录缺签名，未提供复核记录。”可写“若未及时发现，可能影响交接追溯；建议核实复核安排并对照记录检查”。不能说从未复核，也不能说下次必然交接失败。不要用缺记录再造一条“现行措施不存在”的风险。
建议沿用已有控制；措施未说明时先核实，再按实际缺口完善。不要把“未说明是否已有某措施”写成“可能缺少该措施”的独立风险。无需在每句重复未知，但成立条件和重要缺口必须清楚。定级需要适用标准、可能性与影响依据；记录数量不等于容量标准或客观概率。
用户明确要求摘要时
摘要只缩写原事实与建议，不改变状态。例（虚构）：“见三件封口异常，原因未核实，建议复检。”可复制为“发现三件封口异常；原因需核实，建议复检。”不能改为“已安排复检”“已采取封口整改”，也不能保证全部恢复。
完整登记表才补已有控制、拟议应对、责任人、状态、验证及剩余风险。接受风险由有权负责人决定；专业认证或审计结论需要适当复核。最后一项所问风险或摘要结束即结束。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 28 lines · 43 tokens per session scan A 673eeead22e8
bo-risk-assessment is a skill published in the GitHub repository TencentCloud/Octop (9,691 stars, last pushed today), licensed MIT. It adds 43 tokens to every session and 612 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-17.
Other skills, from other repositories
pipeline-conductor
Operating procedure for the kirocrew-pipeline-conductor agent. Use when a pipeline conductor session is seeded, inspected or debugged. You MANAGE one issue/PR pipeline on one repo: two columns per item (session working? item solved?), send intent, never re-derive a red yourself.
babysit
Use when a user asks to babysit, monitor, keep checking, keep an eye on, or report when a pull request, CI run, ticket, deployment, or other changing target reaches an outcome.
feature-request
Conversational workflow for gathering user feedback and filing GitHub Issues on the Kiro Crew repository. Load when the user clicks "Request a Feature", wants to report a bug, or suggest an improvement.
goal-loop
Bootstrap a goal-driven self-improving AutoNudge loop from a goal plus an anchor directory, then run the board autonomously until the Definition of Done is met.
company-employee
The protocol every employee of a PenguinHarness organization follows — read the handbook first, act on [orgtrigger] work runs, schedule tickets from the desk session and do the work in ticket sessions, block instead of idling, ask the board in the all-hands channel before anything heavy, costly, irreversible or…
company-ceo
Run a PenguinHarness organization as its CEO — turn the mission into a ticket tree, hire HR and finance first, partition the shared workspace, schedule the calendar, open a channel per stream, review tickets and report to the board in the all-hands channel.