Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/volcengine/searchcli/vs-sharednpx skills add volcengine/SearchCLI --skill vs-sharedgit clone --depth 1 https://github.com/volcengine/SearchCLIWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00022 | $0.01449 |
| Opus 5 | $0.00011 | $0.00724 |
| Sonnet 5 | $0.00004 | $0.00290 |
| Haiku 4.5 | $0.00002 | $0.00145 |
Grade A, and why
vs-shared scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Viking Shared
When to Use
Use this skill when an external agent is setting up SearchCLI for the first time, or when it needs to check authentication, profiles, and local readiness.
Preconditions
Node.js >= 20is installed- the repository has already been cloned, or the CLI has already been installed with
scripts/install.sh
Commands
auth import-env: importVIKING_AK/VIKING_SKfrom the current shell into the local secure storeauth login: capture AK/SK interactively in a real terminalauth status: inspect the active profile, credential source, and regionauth use: switch profilesauth list: list saved profilesllm login: capture OpenAI-compatible LLM base URL, model, and API key interactively; stores the API key in the local secure storellm import-env: importVIKING_LLM_BASE_URL/VIKING_LLM_API_KEY/VIKING_LLM_MODELinto config plus secure storellm status: inspect the active LLM provider, model, base URL, and secret source without revealing the API keyllm logout: delete the stored LLM API key for a profiledoctor: check local dependencies, auth, and configurationskill list: inspect the published Viking skillsskill install: install Viking skills from the local repository checkoutapp status/app diagnose: inspect app readiness before blaming runtime behaviorsearch run/chat run: run a minimal verification request
Regions
Built-in region checklist (for --region and auth profiles):
- Beijing:
cn-beijing - Johor:
ap-southeast-1
Workflow
- Confirm that the CLI is installed, then run
auth status - If the current shell already has
VIKING_AK/VIKING_SK, preferauth import-env - Otherwise, if the agent can keep an interactive real terminal alive, run
auth login - If interactive login is not possible, ask the user to set
VIKING_AK/VIKING_SKin the current shell and then runauth import-env - Run
doctorto verify the local environment - External agents should install Viking skills with
npx skills add "<repo-url>" -y -g - Repository maintainers can use
skill install allor install named skills from the local checkout - Before deeper debugging, use
app statusorsearch/chat runfor a minimal runtime check
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 85 lines · 22 tokens per session scan A 4e97a368c962
vs-shared is a skill published in the GitHub repository volcengine/SearchCLI (1,176 stars, last pushed 5d ago), licensed Apache-2.0. It adds 22 tokens to every session and 1,449 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
xerj-code
Reference-coding with XERJ. Clone the libraries that already solved your problem, index them locally, and retrieve the exact implementation before writing code — so the agent reads passages instead of re-deriving algorithms across retry loops. Use when starting a task in an unfamiliar API, porting an algorithm, or…
xerj-security-audit
Coverage-guaranteed whitebox security audit of a codebase using XERJ + tree-sitter AST. Use when the user wants to security-review PHP (or other-language) code with a provable "we enumerated every dangerous call" guarantee, or asks to run the WordPress-style sink census / audit. Drives an index-once, query-read-reason…
linkly-ai
Search, browse, read, and take notes across the user's documents indexed by Linkly AI — local files and linked cloud libraries. Use when the user asks to 'search my documents', 'find files about a topic', 'read a local document', 'what's in this folder', 'list the files in that library', 'browse document outlines'…
zero-api-key-web-search
OpenClaw skill for source-backed web search, page reading, and evidence-aware claim checking. No API keys required by default; optional providers can be enabled for stronger coverage. v23: multi-engine SERP (7 engines), Web Unlocker for blocked pages, auto-fallback on 403/429.
zero-api-key-web-search
Claude Code-compatible skill for source-backed web search, page reading, and evidence-aware claim checking. Use it when an answer depends on current facts, live sources, or explicit support/conflict handling. v23: multi-engine SERP (7 engines), Web Unlocker for blocked pages, auto-fallback on 403/429.
zero-api-key-web-search
Codex-compatible skill for source-backed web search, page reading, and evidence-aware claim checking. Use it to verify factual answers with live results and explicit source handling. v23: multi-engine SERP (7 engines), Web Unlocker for blocked pages, auto-fallback on 403/429.