Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vironnimo/vbot/vbot-clinpx skills add Vironnimo/vbot --skill vbot-cligit clone --depth 1 https://github.com/Vironnimo/vbotWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00157 | $0.02470 |
| Opus 5 | $0.00078 | $0.01235 |
| Sonnet 5 | $0.00031 | $0.00494 |
| Haiku 4.5 | $0.00016 | $0.00247 |
Grade A, and why
vbot-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vBot CLI
The vbot CLI is the automation surface for configuring and operating a vBot instance: run the command, verify the result, report what changed. One async Runtime lives behind the server; the CLI, WebUI, Desktop, and Channels are Accessors to that same system rather than separate stores.
System and paths
Keep these boundaries separate:
vbot_rootis the checkout or installation containing vBot code and bundled resources.data_diris the server instance's local runtime state and credentials.~/.vbotis only the product default, not a path to assume.- A Project
cwdis the external working directory where file and shell Tools operate for that Project; it is referenced by Project state but is not contained by the data directory. - An Identity Agent's Workspace is its identity and Memory home. It defaults inside the Agent's data directory but may be configured as an external absolute path.
- A Session is persisted conversation history owned by one Agent; a Run is one active execution inside it and is not a separate top-level data directory.
Run vbot home before local filesystem investigation to resolve vbot_root and data_dir. The command reports the machine where it runs and does not query a server selected with --host; when targeting a remote vBot server, use its CLI/RPC diagnostics unless you separately have filesystem access to that server host.
Read references/system-layout.md before searching runtime files, diagnosing missing or corrupt stored state, making an unavoidable manual edit, or planning a data backup, move, or reset. Use the owning CLI area first and inspect files only when the semantic command cannot answer the question.
Rules
- Primary identifiers are positional (
vbot agent show assistant); secondary parameters are flags.vbot <area> <command> --helpshows exact flags plus a usage example. - Only
server start|stop|restart|status,desktop,update,uninstall,autostart, anddoctorwork without a running target server. Everything else needs one. When operating the vBot instance hosting the current Run, execute the requested command directly — the Run already proves that server is available. Checkvbot server statusand start withvbot server startonly when targeting another instance or troubleshooting connectivity. - Non-default instance: add
--host,--port,--data-dirto every command. - Prefer CLI commands over direct file edits — settings, agents, channels, cron jobs, Bootstrap jobs, prompt blocks, and provider keys all have commands. If a manual JSON edit was unavoidable, validate with
vbot doctor config. - Before
vbot updatewhen it will restart the server, arm and verify a one-shot Bootstrap in the current Session so the Run resumes after startup and checks the result. Followreferences/server.md; do not create one for--no-restartunless the user separately wants a later-startup check. - Never echo secrets in output. API keys go through
provider set-key, extension secrets throughextensions <name> set <field> --stdin, and managed channel tokens throughchannel add ... --token-stdinorchannel set-token ... --stdin. Channel tokens never belong in shell arguments; use--token-envonly when an external deployment environment already owns the variable. - Inspect before changing; verify after with the matching list/show/status command. For Settings, discover paths with
vbot config list [prefix], inspect type/default/lifecycle withvbot config describe <path>, then verify the effective result withvbot config get <path> --details. - Treat
vbot model showandvbot task-model optionsas authoritative for Model capabilities, voices, and accepted Task Model values. Never infer one Model's options from another Model or from generic provider documentation. - Mutation output is a verification result, not merely an acknowledgement: Agent, Project, Channel, Cron, and Bootstrap create/update commands print the saved resource; Project removal prints affected rooted Agents and file-copy/backup effects. Read it before issuing a separate verification call, then use
show/listwhen the requested outcome depends on live discovery or runtime health. - Keep Identity Agent, Project Agent, Workspace, and Project cwd separate. A generic request to create an Agent means an Identity Agent; root it in a Project when its file/shell work should run there. A Project Agent is a repo-discovered Config Agent with no Workspace, SOUL, or Memory and is created only when the user explicitly asks for a Project Team profile. See
references/agents-projects.md. - Follow CLI error hints (
did you mean, candidate lists) before retrying. If another process occupies the port, report it — don't kill it. - Finish with a compact report: commands run, what changed, verification result, and any remaining user action (complete an OAuth login, send a Telegram message, ...).
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/agents-projects.md 10 KB
- references/bootstrap.md 2.6 KB
- references/channels.md 4.7 KB
- references/configuration.md 6.4 KB
- references/cron.md 2.3 KB
- references/diagnostics.md 2.7 KB
- references/memory.md 1.1 KB
- references/providers.md 8.6 KB
- references/server.md 5.9 KB
- references/skills.md 2.7 KB
- references/system-layout.md 7.5 KB
- references/telegram-setup.md 5.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 95 lines · 157 tokens per session scan A 9d97fd43be95
vbot-cli is a skill published in the GitHub repository Vironnimo/vbot (1 stars, last pushed 2d ago), licensed Apache-2.0. It adds 157 tokens to every session and 2,470 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gpt-researcher
GPT Researcher is an autonomous deep research agent that conducts web and local research, producing detailed reports with citations. Use this skill when helping developers understand, extend, debug, or integrate with GPT Researcher - including adding features, understanding the architecture, working with the API…
review-pr
Review a Dograh pull request, branch diff, or pasted patch for repo-specific security and correctness risks that are not obvious from generic FastAPI, Next.js, or Python conventions. Use when the user asks to review a PR, audit a diff, check whether changes are safe to merge, review their own changes, or asks what to…
gpt-researcher
Autonomous deep research from Codex via MCP.
review-agents-md
Audit Dograh AGENTS.md files for drift against the live repo and for bad scope boundaries between parent and child docs. Use when the user asks to review existing AGENTS files, identify stale guidance, decide whether a subtree needs its own AGENTS.md, or update the AGENTS.md hierarchy under the repo root, api/, or ui/.
merge-pipecat-upstream
Merge the latest upstream pipecat-ai/pipecat tag into the pipecat submodule fork (dograh-hq/pipecat) and bump the dograh repo to it. Use whenever the user asks to bump, upgrade, sync, or merge pipecat, resolve pipecat merge conflicts, audit whether upstream changes break or supersede Dograh's in-fork patches, or…
memmachine-memory
Use when an agent or model needs durable project, user, or session context from MemMachine, needs to save information to MemMachine memory, has requests involving mem-cli, memmachine, or memmachineclient, has insufficient conversation context, or is tempted to search local files for prior context that should come from…