Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/washington5533/guarftrain/dsh-plugin)<a href="https://agentmods.dev/skills/washington5533/guarftrain/dsh-plugin"><img src="https://agentmods.dev/badge/skills/washington5533/guarftrain/dsh-plugin.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.02026 |
| Opus 5 | $0.00039 | $0.01013 |
| Sonnet 5 | $0.00016 | $0.00405 |
| Haiku 4.5 | $0.00008 | $0.00203 |
Grade A, and why
dsh-plugin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DSH 社区插件开发与发布
DSH 社区插件 = npm 包（含 dsh 段 + cordis.patch.yml）+ 双目标构建产物
（host ESM → dist/，client CJS + __ModuleLoader__ wrapper → dist-client/），
通过 git tag vX.Y.Z 触发 GitHub Actions 全自动发布（npm → registry → Release）。
规范原文（canonical spec）：docs/PLUGIN_STANDARDS.md — 任何约定冲突时以它为准。
快速参考：references/standards.md（清单速查）、references/registry-schema.md（registry schema）。
本仓库结构
| 位置 | 内容 |
|---|---|
dsh-plugin/dsh-client-ui-training-guardian/ |
参考插件（Training Guardian，本规范的实现范例） |
docs/PLUGIN_STANDARDS.md |
社区插件规范 |
scripts/dsh_plugin_cli.py |
插件 CLI（dsh-plugin，pyproject 已注册） |
scripts/update_registry.py |
registry 条目重算器（CI 与本地共用） |
.github/workflows/plugin-publish.yml |
发布流水线 |
registry/plugins.json |
社区插件 registry |
工作流 1：脚手架（新建插件）
python scripts/dsh_plugin_cli.py scaffold my-cool-plugin \
--author "Your Name" --description "What it does" [--platform web|tui]
- 在仓库内运行：生成
dsh-plugin/my-cool-plugin/，并自动向registry/plugins.json写入条目；若仓库缺scripts/工具链会自动复制。 - 在全新目录运行（
--dir /path/new-repo）：生成完整仓库布局 （dsh-plugin/<slug>/+scripts/+registry/）。 - 生成的骨架已含：package.json（
dsh段）、cordis.patch.yml（insert + meta + skills）、双目标 tsdown.config.ts（含__ModuleLoader__wrapper）、 slot 注入 + skill 注册的 client 入口、locales、slots-augment、vitest 冒烟测试、 双语 README、.github/workflows/plugin-publish.yml。 - 名字规范：npm 包名
@scope/kebab-name或kebab-name；insertid取 kebab-name（全局唯一）。
工作流 2：开发迭代
cd dsh-plugin/<plugin>
pnpm install
pnpm build # tsc --noEmit && tsdown（产出 dist/ + dist-client/）
pnpm test # vitest
pnpm typecheck
改完源码后（本地联调）：pnpm build，dsh-wsl dev 模式会自动 reload client bundle。
实时联调（真机验证）
# 1. DSH web（WSL，用 nvm node + corepack pnpm；Windows PATH 里的 pnpm 在 WSL 不可用）
# wsl -e bash -c '. ~/.nvm/nvm.sh; nvm use 22; cd ~/dsh-wsl && nohup pnpm dsh web &'
# 2. 真训练 + 远程服务（SSE/REST 数据源）
python -m guardian.cli watch --remote --remote-port 8765 -- python scripts/train.py \
--epochs 20 --ckpt_dir ./checkpoints_live --data_dir ./data
# 3. 浏览器自动化验证（.tmp-playwright/，playwright-core + 系统 chromium）
# node .tmp-playwright/live-test.js # 按钮/面板/SSE 指标/REST 全链路
# node .tmp-playwright/test-drag.js # 面板拖拽/吸附/位置持久化
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 143 lines · 78 tokens per session scan A 31c2b1e7ee34
dsh-plugin is a skill published in the GitHub repository Washington5533/guarftrain (1 stars, last pushed 10d ago), licensed MIT. It adds 78 tokens to every session and 2,026 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
nodejs-keccak256
Prevent Ethereum hashing bugs in JavaScript and TypeScript. Node's sha3-256 is NIST SHA3, not Ethereum Keccak-256, and silently breaks selectors, signatures, storage slots, and address derivation. Use when hashing for Ethereum in JavaScript or TypeScript, or when a selector, signature, storage slot, or derived address…
nestjs-patterns
NestJS architecture patterns for modules, controllers, providers, DTO validation, guards, interceptors, config, and production-grade TypeScript backends. Use when building or reviewing a NestJS backend — modules, providers, DTO validation, guards, or interceptors.
angular-developer
Generates Angular code and provides architectural guidance. Trigger when creating projects, components, or services, or for best practices on reactivity (signals, linkedSignal, resource), forms, dependency injection, routing, SSR, accessibility (ARIA), animations, styling (component styles, Tailwind CSS), testing, or…
release-notes
Use when asked to generate release notes, or when the /release-notes command runs — derive user-facing release notes from the change history since the last release.
release-process
Pre-release validation, npm publish procedures, and post-publish verification.
release
Step through versioning, tagging, and verification.