Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add willnie9/agent-skills --skill yapi-to-codegit clone --depth 1 https://github.com/willnie9/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/willnie9/agent-skills/yapi-to-code)<a href="https://agentmods.dev/skills/willnie9/agent-skills/yapi-to-code"><img src="https://agentmods.dev/badge/skills/willnie9/agent-skills/yapi-to-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/willnie9/agent-skills/yapi-to-code"><img src="https://agentmods.dev/badge/skills/willnie9/agent-skills/yapi-to-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.02792 |
| Opus 5.5 | $0.00034 | $0.01117 |
| Sonnet 5.5 | $0.00017 | $0.00558 |
| Haiku 4.5 | $0.00008 | $0.00279 |
Grade A, and why
yapi-to-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.
YApi-to-Code · 接口对接流水线
Auto Mode(无确认模式)
触发:用户输入含任一关键词 → 全跑 / 一气呵成 / auto / yolo / 别问 / 自动,或被 module-flow 委托(auto 透传)。
行为:
- 跳过 Step 3 类型映射预览(强制
showPreview: false,复杂接口也直接写) - 智能发现接口(Step 1.1)自动选分数 ≥ 7 的全要,不弹候选清单
validate-define.mjs失败不阻断(verdict=warn 也继续,落 issues 给上层处理)
保留:
- 文件冲突时仍弹三选(覆盖/重命名/跳过) —— 这是数据安全,不能默认覆盖
- 铁律 1-5 不变
本 skill 读取
.claude/skills/project.config.json获取项目接口目录/响应壳/HTTP 客户端约定。<config.xxx>占位指向该配置;Step 0 同时做"现场探测兜底"。
决策树
输入形态
│
├─ 单个/多个 YApi URL → Step 1.0 直接解析 projectId+apiId
├─ 自然语言("xxx 模块的接口") → Step 1.1 调 yapi_search_apis 模糊搜
└─ 仅给项目名 → Step 1.2 调 yapi_list_projects 列接口让用户选
产出形态
│
├─ 简单接口(< 5字段,无嵌套,无枚举) → 直接写文件
├─ 复杂接口(嵌套≥2/含数组对象/含枚举) → Step 3 给用户预览类型映射后再写
└─ 多接口批量(CRUD 5 件套) → 按"查询→新增→修改→删除→详情"排序写
工作流
Step 0 · Reconnaissance(自检 + 探测项目风格)
执行任何步骤前先自检:
-
YApi MCP 可用:调一次
mcp__yapi-auto-mcp__yapi_list_projects验证。失败立刻告知用户"YApi MCP 未配置"并停止。 -
读项目配置:
config.conventions.responseWrappers/httpClient/httpClientFile/commonTypesFile,以及config.structure.cacheDir(接口目录)。 -
配置缺字段时回退到 grep 探测:
# 项目主流响应壳 grep -rEho "[A-Z][A-Za-z]*Response<" <config.structure.cacheDir>/ | sort | uniq -c | sort -rn | head -5 # 项目 HTTP 客户端调用方式 cat <config.conventions.httpClientFile> | head -20关注:函数签名、请求体位置、是否强制类型断言、错误返回值。
把探测到的"项目主流响应壳 + HTTP 客户端调用方式 + 接口目录约定"记下,后续 Step 2/4 直接沿用。
Step 1 · 拉接口定义
三种入口分支:
Step 1.0 — 精确路径(已知 projectId + apiId)
mcp__yapi-auto-mcp__yapi_get_api_desc({ projectId, apiId })
返回字段速查:method / path / req_params / req_query / req_body_other / res_body / req_body_is_json_schema。
批量场景:并行调,按业务语义排序(查询/新增/修改/删除/详情)。
Step 1.1 — 智能发现(只给 projectId + 模块语义)
适用:被 module-flow 调度时,只拿到模块语义和 YApi 项目 ID,自动找出该模块需要的接口。
// 1. 从模块语义提关键词组(中英文 + camelCase + kebab-case + 拆词)
const keywords = [semantic, moduleSlug, kebab, ...semantic.split(/\s+/)];
// 2. 并行搜每个关键词
const candidates = await Promise.all(
keywords.map((kw) =>
mcp__yapi-auto-mcp__yapi_search_apis({
projectKeyword: String(projectId),
nameKeyword: kw,
limit: 10,
})
)
);
// 3. 去重 + 评分 + 给用户候选清单
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 236 lines · 84 tokens per session scan A b06ca9996c52
yapi-to-code is a skill published in the GitHub repository willnie9/agent-skills (2 stars, last pushed 3mo ago), licensed MIT. It adds 84 tokens to every session and 2,792 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
better-auth
Skill for integrating Better Auth - comprehensive TypeScript authentication framework for Cloudflare D1, Next.js, Nuxt, and 15+ frameworks. Use when adding auth, encountering D1 adapter errors, or implementing OAuth/2FA/RBAC features.
bun-bundler
This skill should be used when the user asks about "bun build", "Bun.build", "bundling with Bun", "code splitting", "tree shaking", "minification", "sourcemaps", "bundle optimization", "esbuild alternative", "building for production", "bundling TypeScript", "bundling for browser", "bundling for Node", or…
bun-hot-reloading
Use when implementing hot reloading with Bun (--hot, --watch), HMR, or automatic code reloading during development. Covers watch mode, hot mode, and HTTP server reload.
phaser-pixi-2d-games
Use when building a 2D web game with Phaser (3.x/4.x) or PixiJS 8 in TypeScript - framework vs renderer, Phaser scenes/game objects/arcade physics/groups as pools/scale manager/loader, scene shutdown cleanup, PixiJS 8 async init, Assets bundles, ticker units and destroy, and keeping rules in plain TS modules.
node-typescript-security-pitfalls
Use when reviewing Node.js or TypeScript server code - Express/Fastify/Nest handlers, Next.js server actions and route handlers, childprocess, ORM raw queries, prototype pollution, template engines, JWT and outbound HTTP clients.
node-typescript-service
Use when building or extending a TypeScript service on Node.js - Fastify, NestJS, Express or Hono, runtime validation at the boundary, strict types, the repository's ORM and migrations, async error handling, graceful shutdown.