Wanwu is an enterprise platform for building AI agents, workflows, retrieval-augmented applications, and managing models in multi-tenant environments. It is designed for developers and enterprise teams delivering AI applications and integrations. The catalogue entries provide skills and agents for using the platform.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add UnicomAI/wanwu --skill managed-model-endpointsgit clone --depth 1 https://github.com/UnicomAI/wanwuWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unicomai/wanwu/managed-model-endpoints)<a href="https://agentmods.dev/skills/unicomai/wanwu/managed-model-endpoints"><img src="https://agentmods.dev/badge/skills/unicomai/wanwu/managed-model-endpoints/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/unicomai/wanwu/managed-model-endpoints"><img src="https://agentmods.dev/badge/skills/unicomai/wanwu/managed-model-endpoints.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 11 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 189 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Data Exfiltration · line 35 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Rogue Agent · line 119 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 130 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 145 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium Privilege Escalation · line 153 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 155 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium MCP Rug Pull · line 153 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium Tool Misuse · line 182 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
- medium Tool Misuse · line 193 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
- low Tool Misuse · line 153 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.02617 |
| Opus 5.5 | $0.00033 | $0.01047 |
| Sonnet 5.5 | $0.00017 | $0.00523 |
| Haiku 4.5 | $0.00008 | $0.00262 |
Grade B, and why
managed-model-endpoints scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
docker run --rm -v "$SERVICE_DIR/cache:/c" alpine sh -c "chown -R $CUID:$CUID /c && chmod 700 /c" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
r = requests.post(BASE_URL + "/v1/infer", json=payload) How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Managed model endpoints
A managed model endpoint is a model service the daemon owns: you
register it once, then every compute_provider cell against it just
works — the daemon swaps the resident model off the device (one model at a
time, via the resident's own approved stop), runs your approved start
script, waits for the readiness route, then runs your cell, streaming its
lifecycle progress into the cell as it goes. You never run the container
runtime yourself, never poll readiness in cells, and never see the
credential value. Two verbs: register() (asks the user once) and ordinary
inference cells.
Container specifics — image, registry login, internal port, cache mount target, readiness route — come from the model's own runbook skill; this skill is the translation contract.
Calling a registered endpoint — inference cells
Calling a registered endpoint — use the using-model-endpoint skill
(this skill is the REGISTRATION contract; that one documents the call
side in full).
The ONLY dispatch form is the compute_provider tool with the endpoint's
registered name (list_compute shows them):
compute_provider(provider="boltz2-service", code="""
import requests
r = requests.post(BASE_URL + "/v1/infer", json=payload)
""")
The daemon brings the model up on demand (a first cold start downloads
image + weights — minutes; let it run) and preloads BASE_URL into the
cell — both as a Python variable (use it directly, as above) and as
os.environ["BASE_URL"] (plus INFER_API_KEY for remote endpoints). Endpoints are
not kernel environments: environment="boltz2-service" on a plain
python cell fails — plain cells get no BASE_URL.
Enablement — once per machine
The user connects the family under Customize → Compute → Model
endpoints (the setup flow saves the family credential first —
connect-without-key is not a state) and picks ONE mode: Local
(container registrations) or URL/remote (https against the configured
host). Until connected, free_port()/register() raise a precise error —
relay it; in the wrong mode they refuse with a teaching error naming the
setting (existing endpoints of the unarmed leg keep dispatching — only NEW
registrations refuse). Disconnecting is a full teardown: every active
local service is stopped via its approved stop script and every
registration (local AND hosted) is removed; caches stay on disk; a failing
stop keeps that one row, FAILED. The "Local machine GPU" toggle never
gates registration — it governs cell GPU access only; the approval card is
the per-registration gate.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 210 lines · 83 tokens per session scan B 48cb2bf810b3
managed-model-endpoints is a skill published in the GitHub repository UnicomAI/wanwu (2,371 stars, last pushed 3d ago), licensed Apache-2.0. It adds 83 tokens to every session and 2,617 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dify
Use when building LLM applications with visual workflow — RAG knowledge bases, AI agents, chatbots with drag-and-drop orchestration. Dify: open-source LLM app platform supporting 30+ models (OpenAI, Claude, DeepSeek, Ollama, Qwen, GLM) with Docker deployment.
ai-skills
Use when building LLM applications, RAG knowledge bases, AI agents, terminal coding agents, multi-model orchestration, plugin-based agent harnesses, or file translation. Index of 14 skills: Dify, LangChain, LlamaIndex, Ollama, Transformers, Hermes Agent, OpenClaw, OpenCode, Pi, DocuTranslate, DeepSeek Harness and more.
ai-engineer
Build production-ready LLM applications, advanced RAG systems, and intelligent agents. Implements vector search, multimodal AI, agent orchestration, and enterprise AI integrations.
ai-ml
AI and machine learning workflow covering LLM application development, RAG implementation, agent architecture, ML pipelines, and AI-powered features.
ai-pipeline-orchestration
Orchestrate AI/ML pipelines for data ingestion, model training, batch inference, and RAG indexing using Prefect, Airflow, or Dagster.
qdrant
Vector search engine for production RAG systems.