CloudBase AI Toolkit is an integration layer that lets AI coding tools use Tencent CloudBase as an application backend, including databases, authentication, functions, storage, and deployments. Developers use it to have coding agents build and operate CloudBase-backed applications through skills, plugins, commands, and chat-accessible tools. The catalogue entries are the toolkit’s own skills, agents, hooks, plugins, rules, instructions, and MCP tools.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TencentCloudBase/CloudBase-AI-Toolkit --skill cloudrun-developmentgit clone --depth 1 https://github.com/TencentCloudBase/CloudBase-AI-ToolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencentcloudbase/cloudbase-ai-toolkit/cloudrun-development)<a href="https://agentmods.dev/skills/tencentcloudbase/cloudbase-ai-toolkit/cloudrun-development"><img src="https://agentmods.dev/badge/skills/tencentcloudbase/cloudbase-ai-toolkit/cloudrun-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tencentcloudbase/cloudbase-ai-toolkit/cloudrun-development"><img src="https://agentmods.dev/badge/skills/tencentcloudbase/cloudbase-ai-toolkit/cloudrun-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 209 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00109 | $0.09272 |
| Opus 5.5 | $0.00044 | $0.03709 |
| Sonnet 5.5 | $0.00022 | $0.01854 |
| Haiku 4.5 | $0.00011 | $0.00927 |
Grade A, and why
cloudrun-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- cloudrun-development — 100% identical, 0 lines differ
- cloudrun-development — 98% identical, 85 lines differ
How it starts
The opening of the file, as written. The whole thing — 452 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sibling skills (local only)
Sibling CloudBase skills ship beside this skill. Use local relative paths such as ../auth-tool-cloudbase/SKILL.md.
If a referenced sibling skill file is missing from this environment, ask the user to install the full CloudBase plugin (or the missing skill). Do not HTTP-fetch remote skill or protocol markdown into the agent context.
Cross-cutting protocols (required before writing HTTP handlers or deploying images):
- Sensitive Runtime Data Protection:
../cloudbase-platform/references/protocols/sensitive-runtime-data-protection.md - Deployment Gate:
../cloudbase-platform/references/protocols/deployment-gate.md
CloudBase Run Development
Activation Contract
Use this first when
- The task is to initialize, run, deploy, inspect, or debug a CloudBase Run service.
- The request needs a long-lived HTTP service, SSE, WebSocket, custom system dependencies, or container-style deployment.
- The task is to create or run an Agent service on CloudBase Run.
- The task migrates an existing / GitHub / third-party backend that uses classic
DATABASE_URL/ TCP database clients. - The service requires a stable independent process (long connections, custom runtime, VPC database access) — see the 「云托管 vs HTTP 云函数」 decision section below. A Dockerfile alone is not a strong trigger.
Read before writing code if
- You still need to choose between Function mode and Container mode.
- The prompt mentions
queryCloudRun,manageCloudRun, Dockerfile, service domains, or public/private access. - The app depends on MySQL, PostgreSQL, Redis, or other VPC-private resources over TCP → 先做数据库访问方式决策（SDK/网关优先，见下方「数据库访问方式决策门」）；确认必须 TCP 直连后 → also read
references/vpc-and-database.md. - You are choosing between CloudRun and HTTP cloud functions for a stateless HTTP service.
- The service calls CloudBase resources (PG
app.rdb(), NoSQL, storage, functions) through an SDK → 先过「计算资源访问 CloudBase 的凭证决策门」：凭证谁签发、怎么注入、怎么吊销，都必须在写代码之前定下来。 - Container deploy fails (
deploy_failed, Pod not ready, readiness/probe failed, third-partyimageUrlwon't stay up) → also readreferences/image-deploy-troubleshooting.mdand follow the Container deploy failure SOP below. Do not start by raisingInitialDelaySeconds.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +5 lines e879384e2f1e
- yesterday Changed · +1 lines 4fba56b0b70b
- 3d ago Changed a20499957da8
- 7d ago Changed · +1 lines 64467e3a8931
- 16d ago Changed f183d2582dd5
- 25d ago Changed 30da6be8341d
- 26d ago Changed f5db634ab131
- 28d ago Changed · +21 lines · +10 tokens per session 893d8f46d856
- 1mo ago Changed d39184cd22da
- 1mo ago First seen · 424 lines · 99 tokens per session scan A b1a5e8bf98c6
cloudrun-development is a skill published in the GitHub repository TencentCloudBase/CloudBase-AI-Toolkit (1,138 stars, last pushed today), licensed MIT. It adds 109 tokens to every session and 9,272 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nginx-reverse-proxy
Configure nginx as a reverse proxy with TLS termination, headers, and upstream health — for self-hosted web apps.
apache
Apache HTTP Server 配置.
stripe-projects
Provision SaaS services + sync creds via Stripe Projects.
django-storages-s3
Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST…
websocket-engineer
Use when building real-time communication systems with WebSockets or Socket.IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.
azure-eventhub-dotnet
Azure Event Hubs SDK for .NET. Use for high-throughput event streaming: sending events (EventHubProducerClient, EventHubBufferedProducerClient), receiving events (EventProcessorClient with checkpointing), partition management, and real-time data ingestion. Triggers: "Event Hubs", "event streaming"…