Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/volcengine/searchcli/vs-user-onboardingnpx skills add volcengine/SearchCLI --skill vs-user-onboardinggit clone --depth 1 https://github.com/volcengine/SearchCLIWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.03716 |
| Opus 5 | $0.00036 | $0.01858 |
| Sonnet 5 | $0.00014 | $0.00743 |
| Haiku 4.5 | $0.00007 | $0.00372 |
Grade A, and why
vs-user-onboarding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vs-user-onboarding
AI Search New User Purchase Onboarding
When to Use
Use this skill when the agent detects that a user needs to complete AI Search purchase / order placement, recover from a missing-auth CLI error, configure local AK/SK, or start using SearchCLI/vs for the first time before continuing with later Viking AI Search workflows.
Common trigger phrases include:
- "I downloaded SearchCLI; how do I use it?"
- "I just installed vs; how do I get started?"
- "我下载了 SearchCLI，帮我看一下如何使用"
- "我刚装了 vs，怎么开始用"
- "我没有火山引擎账号，要怎么开始"
- "帮我接入 / 购买 Viking AI Search"
The agent must route the user to the right entry point, guide the user through the console purchase page when needed, wait for explicit purchase completion, handle the root-account/sub-account key checkpoint, and then guide AK/SK creation or local CLI readiness. Order visibility checks are available only when local AK/SK already exists.
Entry Paths
Choose one entry path before running the workflow, but always start the skill by running vs auth status --json so returning users are not forced through registration again.
| Entry path | Trigger | Start point |
|---|---|---|
| New-user purchase | The user asks to place an order, purchase, activate, open AI Search, or says they are in a new-user registration conversion flow | Step 1, then Step 2 or Step 3 based on auth status |
| Purchased but not configured | The user says they have purchased and needs AK/SK or local CLI setup | Step 5 |
| Missing-auth CLI recovery | A credential-required command fails with the CLI recovery message below | Use the recovery routing rules, then continue at Step 2, Step 5, or Step 6 |
Credential-required commands include product and runtime commands such as vs item ..., vs search run, vs app ..., vs dataset ..., vs recommend ..., and vs purchase order wait.
The CLI missing-auth recovery message is:
You are not authenticated. To get started:
- If you already have AK/SK: run `vs auth login` or `vs auth import-env`.
- If you are new to Viking AI Search: run `vs skill show vs-user-onboarding`.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 217 lines · 72 tokens per session scan A 6003513aaa4a
vs-user-onboarding is a skill published in the GitHub repository volcengine/SearchCLI (1,175 stars, last pushed 6d ago), licensed Apache-2.0. It adds 72 tokens to every session and 3,716 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
xerj-code
Reference-coding with XERJ. Clone the libraries that already solved your problem, index them locally, and retrieve the exact implementation before writing code — so the agent reads passages instead of re-deriving algorithms across retry loops. Use when starting a task in an unfamiliar API, porting an algorithm, or…
xerj-security-audit
Coverage-guaranteed whitebox security audit of a codebase using XERJ + tree-sitter AST. Use when the user wants to security-review PHP (or other-language) code with a provable "we enumerated every dangerous call" guarantee, or asks to run the WordPress-style sink census / audit. Drives an index-once, query-read-reason…
linkly-ai
Search, browse, read, and take notes across the user's documents indexed by Linkly AI — local files and linked cloud libraries. Use when the user asks to 'search my documents', 'find files about a topic', 'read a local document', 'what's in this folder', 'list the files in that library', 'browse document outlines'…
flowzap-diagrams
Generate, validate and publish workflow, sequence and architecture diagrams, using FlowZap Code DSL. Use when the user asks to create a workflow, flowchart, sequence diagram, process map or an architecture diagram. Produces .fz code and instant shareable playground URLs via the FlowZap MCP server.
zero-api-key-web-search
OpenClaw skill for source-backed web search, page reading, and evidence-aware claim checking. No API keys required by default; optional providers can be enabled for stronger coverage. v23: multi-engine SERP (7 engines), Web Unlocker for blocked pages, auto-fallback on 403/429.
zero-api-key-web-search
Claude Code-compatible skill for source-backed web search, page reading, and evidence-aware claim checking. Use it when an answer depends on current facts, live sources, or explicit support/conflict handling. v23: multi-engine SERP (7 engines), Web Unlocker for blocked pages, auto-fallback on 403/429.