Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vod-studio/violet/api-toolchainnpx skills add VOD-Studio/violet --skill api-toolchaingit clone --depth 1 https://github.com/VOD-Studio/violetWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00061 | $0.00641 |
| Opus 5 | $0.00030 | $0.00320 |
| Sonnet 5 | $0.00012 | $0.00128 |
| Haiku 4.5 | $0.00006 | $0.00064 |
Grade A, and why
api-toolchain scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Go 工具链执行决策
按顺序走，停止在第一个命中分支：
go version本机可用 → 直接执行，本 skill 到此为止。- 本机无 Go，且已有用户决定（会话上下文或长期记忆中有记录）→ 按记录的决定路由，而非按安装状态：
- 决定为「安装」→ 安装流程未完成（曾中断）则继续协助安装，装完走 1；仅当用户明确改口才转「拒绝」。
- 决定为「拒绝」→ 走下方容器方案。
- 本机无 Go，无决定 → 问用户一次「是否在本机安装 Go？」
- 允许 → 协助安装，装完走 1。
- 拒绝 → 走容器方案。
- 无论哪个回答，立即用
learn记录决定，后续会话直接命中分支 2，不再重复询问。
容器方案（用户决定不装 Go 时）
项目以 compose 起 dev 环境时，go 命令一律进容器执行：
- 定位 compose 文件（
docker-compose*.yml/compose.y*ml）与 api service 名（docker compose -f <file> config --services，或docker compose ps的 Service 列按容器名映射）。 - 形态：
docker compose -f "<file>" exec -T "<svc>" go test ./...；-T禁用 TTY，输出可直接进管道。占位符替换为实际值时保持引号。 - Makefile 目标在宿主机不可用时，把目标 recipe 里的 go 命令搬进容器执行（参数以 Makefile 当前定义为准）：
$(VAR)类 make 变量先在 make 层展开成实际值再搬，不原样粘贴。recipe 里的cd <dir>类相对路径，先看该路径在容器内的挂载点（compose 文件volumes:映射，或docker compose exec <svc> pwd确认工作目录），再换成容器内路径。 - codegen / 迁移工具容器内缺失时向用户报告，不在宿主机安装。
- 前提容器在运行：
docker compose ps确认；未启动则从 Makefile help 找启动目标——选纯 compose up 的，走本地脚本、依赖本机工具链的目标同样不可用。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 28 lines · 61 tokens per session scan A 4d91bd4c48e5
api-toolchain is a skill published in the GitHub repository VOD-Studio/violet (2 stars, last pushed 2d ago), licensed MIT. It adds 61 tokens to every session and 641 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
openspec-sync-specs
Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
testing-the-mcp-server
Test the libtmux-go MCP server end to end — drive the real binary over raw JSON-RPC, run the exhaustive advertised-schema gate, and point installed agent CLIs (Claude, Codex, Cursor, Gemini, grok, agy, opencode) at a local build. Use when verifying the server beyond go test, checking a branch works in a real client…
dark-memory
Use for governance, memory, drift detection, and audit trail via dark-memory-mcp. Covers 52 canonical + 3 red-team tools across 16 namespaces: session lifecycle, agentmemory CRUD+search, vibe-flow spec/artifact publish + drift, LLM-as-judge, delegation+mindset, research, observability, error observatory, governance…
audit-network-security
../../../.github/skills/audit-network-security/SKILL.md.
ddd-go-backend
Build production-ready Go backend services following DDD-layered architecture. Covers project scaffolding, config (Viper), database (GORM + MySQL/PostgreSQL), object storage (S3/MinIO), OAuth2 + JWT auth, OpenTelemetry tracing + Jaeger visualization, Zap logging, middleware patterns, and API routing. Use when creating…
openspec-update-change
Update an OpenSpec change by revising its existing planning artifacts and keeping them coherent with one another. Use when the user wants to revise a change's plan, fold new decisions into it, or reconcile its artifacts after an edit. Never edits code.