AgentDock is a runtime that gives AI agents controlled access to files, commands, Git, browsers, containers, and other tools on local computers and remote servers. It is used to let agents write and test code, manage services, inspect systems, and coordinate work across multiple machines within explicit permissions.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add uvwt/agentdock --skill skill-installationgit clone --depth 1 https://github.com/uvwt/agentdockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/uvwt/agentdock/skill-installation)<a href="https://agentmods.dev/skills/uvwt/agentdock/skill-installation"><img src="https://agentmods.dev/badge/skills/uvwt/agentdock/skill-installation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/uvwt/agentdock/skill-installation"><img src="https://agentmods.dev/badge/skills/uvwt/agentdock/skill-installation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 134 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.02137 |
| Opus 5.5 | $0.00019 | $0.00855 |
| Sonnet 5.5 | $0.00010 | $0.00427 |
| Haiku 4.5 | $0.00005 | $0.00214 |
Grade A, and why
skill-installation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Installation
用于把本地或外部 Skill 安全地纳入当前 AgentDock，并验证所选来源候选确实可用。
AgentDock 的 managed Skill 只有“当前内容”，没有独立版本选择、activate 或 rollback。更新同名 managed Skill 等价于审查新内容后原子替换当前目录；相同 content_digest 为 no-op。
完整安全审查规范见包内 references/skill-security-review.md。
核心原则
- 先静态审查，后安装；安装器基础校验不能替代安全审查。
- 来源、安全风险、source digest、content digest 和缺失配置必须可追溯。
- 默认只读；写入、删除、上传、权限变化和依赖安装必须明确识别。
- 不替用户生成、猜测或迁移真实秘密。
- managed Skill 环境与包内容分离；更新当前内容不得覆盖环境或持久数据。
- 同名不同来源是不同候选，运行时只使用宿主返回的精确
skill_ref。 - 不通过历史版本、activate 或 rollback 恢复旧内容；需要恢复时重新安装一个经过审查的来源快照。
来源与身份
安装来源可以是：
- 本地目录；
- 本地 ZIP；
- HTTPS URL。
安装前记录安全来源标签；URL 中认证信息、query 和 fragment 不写入报告或日志。
Skill 的文档身份由 SKILL.md.name 给出。managed 安装目标是：
~/.agentdock/skills/<name>/
目录本身就是“已安装当前内容”的事实来源，不存在额外 active pointer 或 revision 目录。
Frontmatter
确认根目录 SKILL.md：
name存在并符合命名规则；description非空且能表达触发场景；- 正文非空；
name遵守 1–64 字符、仅小写 ASCII 字母/数字/-、不首尾-、不含连续--；description最长 1024 字符；- 其他第三方 frontmatter 原样保留，不因 AgentDock 不认识字段或字段形状而拒绝安装；
- 未把
version、active_version、activate、rollback 当作 AgentDock Skill 生命周期。
发现 agentdock.yaml、旧统一执行协议或旧 Skill Runtime 设计时，停止安装并要求迁移。
静态安全审查
至少检查：
- 所有普通、隐藏、脚本、测试、依赖与锁文件；
- 网络目标、协议、上传数据和下载后执行；
- Shell/子进程和用户输入拼接；
- 文件读取、写入、覆盖、删除、路径穿越；
- 权限、启动项、计划任务和持久化；
- API Key、Token、Cookie、私钥、浏览器状态、SSH/云凭据；
- 外部依赖、安装钩子和二进制；
- 日志和异常是否泄露秘密；
- 破坏性动作是否要求用户确认；
- 符号链接与特殊文件。
风险分级：
| 等级 | 含义 | 默认处理 |
|---|---|---|
| low | 纯文档或行为明确且低风险 | 可继续 |
| medium | 有明确网络、写入或普通依赖 | 展示风险后继续 |
| high | 涉及敏感数据、广泛访问、删除或持久化 | 需明确确认 |
| blocked | 危险行为不可接受或无法解释 | 停止 |
环境变量
从正文提取变量名、类型、必填性与用途。
standalone managed Skill 使用：
~/.agentdock/env/skill/<skill-name>.env
~/.agentdock/data/skills/<skill-name>/
Plugin-owned Skill 使用精确 skill_ref 管理独立环境和数据：
~/.agentdock/env/skill/plugin/<plugin>/<skill>.env
~/.agentdock/data/skills/.plugin/<plugin>/<skill>/
通过 skill_manage env_list/env_set/env_unset 管理环境；工具不会返回真实值。
standalone managed 和 Plugin-owned Skill 执行时都会获得独立 SKILL_DATA_DIR。Plugin-owned Skill 另外获得共享 PLUGIN_DATA_DIR=~/.agentdock/data/plugins/<plugin>/。Windows 原生命令收到 Host 路径，WSL 收到已转换的 Linux 路径；两个变量都不能通过 skill_manage env_set、宿主 env mapping 或请求级 env 覆盖。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed · -3 lines 85f0b783519e
- 28d ago Changed · -2 lines 49c6f60c6147
- 29d ago Changed · -70 lines · +2 tokens per session 2c9981eda9bb
- 1mo ago Changed · +13 lines · +3 tokens per session 38b8c14afcc0
- 1mo ago First seen · 297 lines · 43 tokens per session scan A 41560731a67d
skill-installation is a skill published in the GitHub repository uvwt/agentdock (1,268 stars, last pushed 2d ago), licensed Apache-2.0. It adds 48 tokens to every session and 2,137 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pkf-writing
Author, update, convert, validate, persist, and render PKF (.pkf) content through message-inline, Library Asset, or Memory Page carriers. Use for structured reports, knowledge pages, delivery cards, or any .pkf body. NOT for recall, memory-graph placement, or curation decisions — those belong to the memory skill.
prismer-python-debugpy
Debug Python: pdb REPL + debugpy remote (DAP).
memory-import
Bulk-import an external knowledge base into Prismer memory via the three-layer import pipeline (07 §3.1). Use when the user asks to import/migrate documents, a knowledge base, or notes into workspace memory. Layer 1 lands raw documents (zero LLM, instantly searchable); Layer 2 is YOUR distillation work — you read the…
sora-taira-testnet
Work against the SORA Taira testnet through its deployed Torii MCP endpoint for live account, asset, alias, contract, governance, Musubi package-registry, and transaction workflows. Use when Codex needs to inspect or mutate the Taira testnet, verify or add https://taira.sora.org/v1/mcp, prefer the curated iroha. tool…
gateway
Start and manage the Kurtosis gateway for Kubernetes. The gateway forwards local ports to the Kurtosis engine and services running in a k8s cluster. Required when using Kurtosis with Kubernetes. Use when kurtosis engine status shows nothing on k8s or services aren't reachable.
conventions
Spring Boot project conventions and mandatory rules. Auto-loads when working with Spring Boot, Java, or Maven projects. Enforces No-Lombok, constructor injection, RestClient, and other standards.