Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/volcengine/searchcli/vs-item-onboardingnpx skills add volcengine/SearchCLI --skill vs-item-onboardinggit clone --depth 1 https://github.com/volcengine/SearchCLIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/volcengine/searchcli/vs-item-onboarding)<a href="https://agentmods.dev/skills/volcengine/searchcli/vs-item-onboarding"><img src="https://agentmods.dev/badge/skills/volcengine/searchcli/vs-item-onboarding.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00086 | $0.12957 |
| Opus 5 | $0.00043 | $0.06478 |
| Sonnet 5 | $0.00017 | $0.02591 |
| Haiku 4.5 | $0.00009 | $0.01296 |
Grade B, and why
vs-item-onboarding scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
| PUT upload | `curl -X PUT --data-binary @<path> "<FileUrl>"` | Upload the local file to TOS (no auth header needed) | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| PUT upload | `curl -X PUT --data-binary @<path> "<FileUrl>"` | Upload the local file to TOS (no auth header needed) | How it starts
The opening of the file, as written. The whole thing — 468 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Viking Item Onboarding
Language Matching (apply throughout)
Match the language of the user's most recent message in every line of prose you write — confirmation prompts, status notes, hand-off summaries, questions, error explanations, and any internal thinking / reasoning / planning output that the host may surface (e.g. <thinking> blocks, "thinking" panels, scratchpad notes, todo descriptions). If the user is writing in Chinese, every prose line and every reasoning line must also be in Chinese; if English, English; same for Japanese, etc. The fact that this skill file is written in English is for documentation only — at runtime translate all prose and reasoning into the user's language. Do not switch back to English mid-flow just because the surrounding skill text is English.
Chinese-user priority (the most common case) — when current_query or the most recent user message is in Chinese:
- All prose you write for the user (confirmation prompts, status notes, error explanations, final hand-off summaries) must be in Chinese.
- All internal thinking / reasoning / planning output (thinking blocks, scratchpad, todo descriptions) must also be in Chinese.
- For workspace artifacts you create, the description / comment portions (excluding CLI-contract English identifiers) should also prefer Chinese.
Do not translate the following — keep them verbatim so the contract stays machine-checkable:
- The verbatim CLI block between
<!-- vs-schema-confirm: BEGIN -->and<!-- vs-schema-confirm: END -->(English section labels**Metadata**/**Fields (N)**/**Field Roles**/**Warnings (N)**and English warning text come straight from the CLI). - CLI command names, flag names, JSON keys, enum values, field names, primary-key BizAttr identifiers (
MultiModalId), dataset IDs / app IDs / TaskIDs, and console URLs. - The single literal token the user must reply to confirm — write it as
`yes`in any language so the contract for advancing to step 8 is unambiguous (you may add a parenthetical native-language hint, e.g.回复 \yes`（即"确认"）继续`).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 468 lines · 86 tokens per session scan B be3dd5cdde88
vs-item-onboarding is a skill published in the GitHub repository volcengine/SearchCLI (1,175 stars, last pushed 7d ago), licensed Apache-2.0. It adds 86 tokens to every session and 12,957 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
airflow-translations
Add or update translations for the Apache Airflow UI. Guides through setting up locales, scaffolding translation files, translating with locale-specific guidelines, and validating results. Use when working with i18n tasks in airflow-core/src/airflow/ui/public/i18n/locales/.
muapi-cinema-director
Direct high-fidelity cinematic video with AI — translates creative intent into technical cinematographic directives for Veo3, Kling, and Luma video models via muapi.ai.
xerj-code
Reference-coding with XERJ. Clone the libraries that already solved your problem, index them locally, and retrieve the exact implementation before writing code — so the agent reads passages instead of re-deriving algorithms across retry loops. Use when starting a task in an unfamiliar API, porting an algorithm, or…
xerj-security-audit
Coverage-guaranteed whitebox security audit of a codebase using XERJ + tree-sitter AST. Use when the user wants to security-review PHP (or other-language) code with a provable "we enumerated every dangerous call" guarantee, or asks to run the WordPress-style sink census / audit. Drives an index-once, query-read-reason…
seo
SEO 增长引擎。GSC 分析、关键词研究、标题优化、多语言翻译、内链策略、技术审计。当用户提到 SEO、CTR、曝光、踩词、优化标题、搜索排名、GSC、内链、写博客、翻译文章时路由到此。.
linkly-ai
Search, browse, read, and take notes across the user's documents indexed by Linkly AI — local files and linked cloud libraries. Use when the user asks to 'search my documents', 'find files about a topic', 'read a local document', 'what's in this folder', 'list the files in that library', 'browse document outlines'…