Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TencentCloudBase/awesome-miniprogram-skills --skill shopping-skillgit clone --depth 1 https://github.com/TencentCloudBase/awesome-miniprogram-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencentcloudbase/awesome-miniprogram-skills/shopping-skill)<a href="https://agentmods.dev/skills/tencentcloudbase/awesome-miniprogram-skills/shopping-skill"><img src="https://agentmods.dev/badge/skills/tencentcloudbase/awesome-miniprogram-skills/shopping-skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01072 |
| Opus 5 | $0.00010 | $0.00536 |
| Sonnet 5 | $0.00004 | $0.00214 |
| Haiku 4.5 | $0.00002 | $0.00107 |
Grade A, and why
shopping-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
shopping-skill 潮玩购物场景
业务流程图
用户意图
│
├─ 模糊意图（"想逛逛/看看有什么潮玩"）─→ searchProducts(keyword='') → 推荐列表卡片
│ │
├─ 明确关键词（"Molly/SP/盲盒/手办"）─→ searchProducts(keyword) → 搜索结果卡片 ─┤
│ │
│ 用户点击卡片选择某款商品 │
│ ↓ │
│ getProductDetail → 商品详情卡片 │
│ │ │
│ ┌───────────────┴───────────────┐ │
│ ↓ ↓ │
│ 用户点击"查看门店库存" 用户点击"立即购买" │
│ ↓ ↓ │
│ checkStoreStock → 库存卡片 placeOrder → 下单成功卡片 │
│ │
└─ 查询门店库存（"XX在哪有货"）──→ checkStoreStock → 门店库存卡片
Agent 不能跳过 getProductDetail 直接调 placeOrder——必须先有 getProductDetail 返回的有效 productId。 Agent 不能编造 productId 或 storeId——必须来自上游接口返回的原值。 placeOrder 未返回成功前，禁止向用户宣布"已下单成功"。
原子接口依赖关系
| 接口 | 作用 | 组件 | 前置条件 |
|---|---|---|---|
| searchProducts | 搜索/推荐潮玩商品 | product-list-card | — |
| getProductDetail | 查看商品详情 | product-detail-card | 已有 productId（来自 searchProducts） |
| checkStoreStock | 查询门店库存 | stock-check-card | 已有 productId（来自 getProductDetail） |
| placeOrder | 下单购买 | order-success-card | 已有 productId + storeId（来自 getProductDetail/checkStoreStock） |
业务约束（跨接口铁律）
1. 输出形态
- 所有成功返回的接口（isError=false）且绑定了组件的，必须展示卡片，禁止以纯文本列出卡片中的详情数据。
- Agent 回复时可附加一句简短引导话术（如"为你推荐了这些潮玩，点击卡片查看详情"），但禁止把商品名、价格等以 markdown 列表形式展开。
2. 执行顺序
placeOrder必须在调用成功（isError=false）后才能向用户宣布"下单成功"。placeOrder必须在getProductDetail成功后调用。- 禁止并发调用
placeOrder；须等上一笔结束后再发起下一笔。
What ships with it
30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- apis/checkStoreStock.js 2.1 KB runs code
- apis/getProductDetail.js 2.1 KB runs code
- apis/placeOrder.js 4.2 KB runs code
- apis/searchProducts.js 2.8 KB runs code
- cloudbaserc.json 752 B
- cloudfunctions/shopping-skill-handler/index.js 1.6 KB runs code
- cloudfunctions/shopping-skill-handler/package.json 138 B
- components/order-success-card/index.js 1.4 KB runs code
- components/order-success-card/index.json 24 B
- components/order-success-card/index.wxml 1.3 KB
- components/order-success-card/index.wxss 2.5 KB
- components/product-detail-card/index.js 3.3 KB runs code
- components/product-detail-card/index.json 24 B
- components/product-detail-card/index.wxml 1.2 KB
- components/product-detail-card/index.wxss 2.7 KB
- components/product-list-card/index.js 2.6 KB runs code
- components/product-list-card/index.json 24 B
- components/product-list-card/index.wxml 1.1 KB
- components/product-list-card/index.wxss 2.5 KB
- components/stock-check-card/index.js 2.7 KB runs code
- components/stock-check-card/index.json 24 B
- components/stock-check-card/index.wxml 1.1 KB
- components/stock-check-card/index.wxss 2.1 KB
- data/seed.js 4.3 KB runs code
- index.js 903 B runs code
- mcp.json 7.5 KB
- mp-skills.json 154 B
- README.md 2.3 KB
- utils/id.js 283 B runs code
- utils/storage.js 1.7 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 86 lines · 19 tokens per session scan A c63477b3981f
shopping-skill is a skill published in the GitHub repository TencentCloudBase/awesome-miniprogram-skills (36 stars, last pushed 2mo ago), licensed MIT. It adds 19 tokens to every session and 1,072 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gzh_article
A workflow for creating articles for WeChat Official Accounts, a Chinese publishing platform. It covers choosing a topic, researching sources, writing, adding images, checking the wording, and formatting the finished article.
ckjia-shopping
A shopping search and price-comparison tool for Taobao, JD.com, Tmall, and Pinduoduo, with image-based product recognition. It requires the ckjia-shopping service and its access key to be enabled.
cloudbase-wechat-integration
A guide for connecting CloudBase applications to WeChat services, including payments, official accounts, and user identity.
weapp-vite-best-practices
An engineering guide for building small-program projects with weapp-vite, a Vite-based toolchain for compiling mini-apps for several platforms.
native-to-weapp-vite-wevu-migration
A step-by-step guide for gradually moving native WeChat, Alipay, or Douyin mini-programs to weapp-vite, with an optional later move to Vue single-file components.
docs-and-website-sync
A synchronization guide for keeping source code, website pages, READMEs, packaged documentation, and public coding-agent instructions consistent in a monorepo.