SearchCLI is a command-line interface for connecting agent or business systems to Volcengine’s search, recommendation, and conversational-retrieval services. It is for developers who need to onboard data, build and test retrieval workflows, adjust search strategies, inspect poor results, and verify changes. Its catalogue entries provide installable skills for operating these workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add volcengine/SearchCLI --skill vs-sharedgit clone --depth 1 https://github.com/volcengine/SearchCLIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/volcengine/searchcli/vs-shared)<a href="https://agentmods.dev/skills/volcengine/searchcli/vs-shared"><img src="https://agentmods.dev/badge/skills/volcengine/searchcli/vs-shared/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/volcengine/searchcli/vs-shared"><img src="https://agentmods.dev/badge/skills/volcengine/searchcli/vs-shared.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 53 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Excessive Agency · line 59 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 79 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 82 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01573 |
| Opus 5.5 | $0.00009 | $0.00629 |
| Sonnet 5.5 | $0.00004 | $0.00315 |
| Haiku 4.5 | $0.00002 | $0.00157 |
Grade A, and why
vs-shared scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Viking Shared
When to Use
Use this skill when an external agent is setting up SearchCLI for the first time, or when it needs to check authentication, profiles, and local readiness.
Version Check
Before starting this skill workflow, run vs version check --json. Continue only when status is up-to-date. If status is update-available, stop and tell the user to update the cloned vs repository, then run git pull --ff-only, bash ./scripts/install.sh, and bash ./scripts/install-skills.sh all --target auto --force (PowerShell: scripts/install.ps1 and scripts/install-skills.ps1). If the status is unknown, stop and report that the CLI version could not be verified.
Preconditions
Node.js >= 20is installed- the repository has already been cloned, or the CLI has already been installed with
scripts/install.sh
Commands
auth import-env: importVIKING_AK/VIKING_SKfrom the current shell into the local secure storeauth login: capture AK/SK interactively in a real terminalauth status: inspect the active profile, credential source, and regionauth use: switch profilesauth list: list saved profilesllm login: capture OpenAI-compatible LLM base URL, model, and API key interactively; stores the API key in the local secure storellm import-env: importVIKING_LLM_BASE_URL/VIKING_LLM_API_KEY/VIKING_LLM_MODELinto config plus secure storellm status: inspect the active LLM provider, model, base URL, and secret source without revealing the API keyllm logout: delete the stored LLM API key for a profiledoctor: check local dependencies, auth, and configurationskill list: inspect the published Viking skillsskill install: install Viking skills from the local repository checkoutapp status/app diagnose: inspect app readiness before blaming runtime behaviorsearch run/chat run: run a minimal verification request
Regions
Built-in region checklist (for --region and auth profiles):
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +4 lines 41f0f2d539c2
- 1mo ago First seen · 85 lines · 22 tokens per session scan A 4e97a368c962
vs-shared is a skill published in the GitHub repository volcengine/SearchCLI (1,188 stars, last pushed 2d ago), licensed Apache-2.0. It adds 22 tokens to every session and 1,573 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
xerj-code
Reference-coding with XERJ. Clone the libraries that already solved your problem, index them locally, and retrieve the exact implementation before writing code — so the agent reads passages instead of re-deriving algorithms across retry loops. Use when starting a task in an unfamiliar API, porting an algorithm, or…
xerj-security-audit
Coverage-guaranteed whitebox security audit of a codebase using XERJ + tree-sitter AST. Use when the user wants to security-review PHP (or other-language) code with a provable "we enumerated every dangerous call" guarantee, or asks to run the WordPress-style sink census / audit. Drives an index-once, query-read-reason…
zens-ink
Free SEO toolkit for indie builders. 22 zero-dependency Python tools covering the full SEO workflow: keyword discovery (Google Autocomplete), keyword clustering (semantic grouping), keyword difficulty (SERP structure analysis, no Ahrefs needed), KGR opportunity scoring, search volume (Bing + Brave), real Ahrefs Domain…
geo-readiness
Make a site citable by AI engines (ChatGPT, Perplexity, Google AI Overviews) — Generative Engine Optimization. Audits robots.txt AI-crawler policy and the llms.txt layer, generates llms.txt / llms-full.txt from a static build or sitemap, and plans Query Fan-out content (the sub-queries AI engines spawn from a seed…
keyword-research
Find low-competition keyword opportunities without paid tools (Ahrefs, Semrush). Runs real zero-dependency Python CLIs: Google Autocomplete discovery (with a-z long-tail expansion), semantic clustering, Bing volume lookup, and automated KGR opportunity scoring. Use when the user wants keyword ideas for a niche, asks…
competitor-gap
Find content competitors rank for that the user does not, by diffing sitemaps — no paid tool, no login. Turns the gap into a prioritized content opportunity matrix (cluster x score). Use when the user asks "what content is my competitor ranking for that I'm missing", "compare my site to COMPETITOR", "what should I…