Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/wecomteam/wecom-cli/wecomcli-contactnpx skills add WecomTeam/wecom-cli --skill wecomcli-contactgit clone --depth 1 https://github.com/WecomTeam/wecom-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wecomteam/wecom-cli/wecomcli-contact)<a href="https://agentmods.dev/skills/wecomteam/wecom-cli/wecomcli-contact"><img src="https://agentmods.dev/badge/skills/wecomteam/wecom-cli/wecomcli-contact.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.00912 |
| Opus 5 | $0.00032 | $0.00456 |
| Sonnet 5 | $0.00013 | $0.00182 |
| Haiku 4.5 | $0.00006 | $0.00091 |
Grade A, and why
wecomcli-contact scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- wecomcli-contact — 92% identical, 2 lines differ
What it actually says
企业微信联系人搜索
执行任何
wecom-cli命令前，必须先读取并完成wecomcli-shared技能的公共前置检查。
使用 wecom-cli 按关键词搜索企业微信通讯录中的人员。
接口
按关键词批量模糊搜索人员，一次最多 10 个关键词，返回命中 users 数组（姓名 / 英文名 / 职务 / 部门）。关键词可匹配的字段包括：姓名（用户名）、姓名拼音、英文名、别名，而不仅限于中文名和别名。
命令
wecom-cli contact users search --json '<JSON 参数>'
参数
| 字段 | 类型 | 必填 | 默认值 | 语义 |
|---|---|---|---|---|
keywords |
string[] | 是 | — | 搜索关键词列表，可按姓名（用户名）/ 拼音 / 英文名 / 别名匹配，最多 10 个；多个关键词之间是 OR 关系 |
search_mode |
string | 否 | — | 搜索模式，默认不传该参数；仅当需要拿到完整人员名单时，才显式传 "list" |
- 默认（不传
search_mode）：返回最相关的候选结果，用于常规按名 / 拼音等查单个人的场景，绝大多数场景走此分支。 - 传
search_mode = "list"：返回全量命中列表。仅当用户明确要"完整名单"时才传，典型话术如"一共有几个张三 / 所有叫李四的人 / 列出全部同名 / 全部同名人员"等清点、穷举意图；此时不受"前 5 位"展示上限约束。
返回
| 字段 | 类型 | 说明 |
|---|---|---|
users |
array | 命中的用户列表 |
users[].userid |
string | 用户唯一标识 |
users[].name |
string | 中文姓名 |
users[].alias |
string | 英文名 / 别名（可能为空） |
users[].email |
string | 邮箱（可能为空） |
users[].position |
string | 管理职务（如"负责人"），不是"职位"（可能为空） |
users[].matched_keywords |
string[] | 本条 user 命中的请求关键词 |
users[].departments |
string[] | 所在部门路径列表（从大到小），主部门靠前 |
hint |
string | 结果限制提示（可能为空）：当某个关键词的命中结果因限制未完整返回时，接口会在此字段给出说明 |
users_count |
integer | users 数组元素数量 |
使用规则
- 歧义展示上限：同一关键词下候选超过 5 位时，只展示前 5 位（附姓名 / 英文名 / 职务等区分信息），告知用户"若目标不在其中可要求『查看更多』"，仅在用户明确要求时再展开下一批；
- 展示顺序：必须严格按照接口返回
users数组的原始顺序展示，不得自行随机排序、重排或打乱次序。 - 结果限制提示：当返回中 hint 字段非空时，必须在回复中告知用户"当前返回内容有限，仅返回了部分结果"，并可结合 hint 内容说明受限原因。
缺少参数
必填参数缺失（未提供搜索关键词）且上下文无法推断时，用简洁自然语言向用户追问缺失信息，不得猜测默认值。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 59 lines · 64 tokens per session scan A d78f735e5513
wecomcli-contact is a skill published in the GitHub repository WecomTeam/wecom-cli (3,014 stars, last pushed 9d ago), licensed MIT. It adds 64 tokens to every session and 912 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…