Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/XBuilderLAB/cheat-on-skillnpx agentmods add skills/xbuilderlab/cheat-on-skill/skill-scanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xbuilderlab/cheat-on-skill/skill-scan)<a href="https://agentmods.dev/skills/xbuilderlab/cheat-on-skill/skill-scan"><img src="https://agentmods.dev/badge/skills/xbuilderlab/cheat-on-skill/skill-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xbuilderlab/cheat-on-skill/skill-scan"><img src="https://agentmods.dev/badge/skills/xbuilderlab/cheat-on-skill/skill-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00152 | $0.02898 |
| Opus 5.5 | $0.00061 | $0.01159 |
| Sonnet 5.5 | $0.00030 | $0.00580 |
| Haiku 4.5 | $0.00015 | $0.00290 |
Grade A, and why
skill-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/skill-scan — 高薪 × 可学 × AI 增强 的交集挖掘（核心）
核心方法（先读这条）
不搜"AI 高薪职业 Top10"那类水文——它们利益不中立，是卖课/培训机构的获客漏斗。 真正诚实的需求信号是 BOSS 直聘的真实在招岗位：某岗位在招、给得起价 = 有人真在花钱买这个能力； 岗位数涨=需求升，降=红海。再叠加你的能力画像，挑出"高薪 × 你学得动 × AI 时代仍要"三个圈的交集。
铁律
- 主信源是真实招聘数据（BOSS adapter + 招聘趋势），"职业推荐"水文不作依据。
- 绝不凭记忆。薪资量级、岗位热度、技能要求一律实时取（BOSS / 网页检索加年份）。
- 每个岗位先过 AI 影响分类（
ai-impact-taxonomy.md）：替代型直接劝退，只推增强 / 新生。 - 每个岗位按用户起点算可学性（
learnability-rubric.md），低于阈值不列为首选。 - 按档位收敛（
role-tiers.md）：别给 S0 推够不着的算法岗，别给 S3 推标注。 - 任何带"培训/内推/包就业"的机会过反诈（
anti-scam-rubric.md）。 - 诚实标注 BOSS 数据边界：薪资数字被字体混淆（▯ 占位），只拿到量级；精确值要用户手动看详情页。
- 详情页只读需用户点名：只读取用户明确选择的详情链接；用户可以从候选里选任意数量，也可以少选或不选。读取时保持低频顺序执行，只提取岗位标题、公司、薪资、地点/地址、JD/要求文本；不读取/保存 HR 信息，不点"立即沟通"，不做无选择的批量抓取。
流程
Step 0 — 读上下文
- 读
.skill-state.json拿画像 +profile.start_tier（无 → 路由skill-init）。 - 读
../../shared-references/role-tiers.md（按档位分流）。 - 读
../../shared-references/ai-impact-taxonomy.md（方向闸门）。 - 读
../../shared-references/learnability-rubric.md（可学性打分）。 - 读
../../shared-references/anti-scam-rubric.md（反诈，用于培训/内推类）。 - 读
lessons.md（若存在）：用户过往复盘沉淀，优先参考。 - 任何写入
found_at/found_at_full前，先用系统时间取当前时间：
date '+%Y-%m-%d %H:%M %Z %z'
found_at 写日期，found_at_full 写具体时间和时区，跟用户系统时区走（例：2026-06-26 22:06 CST +0800）。对用户展示时写成 2026-06-26 22:06（本机时区 + UTC 偏移，如 中国标准时间 CST，UTC+8），不要写死成某个固定国家的时间。
Step 1 — 按档位锁定搜索词
先按 start_tier 限定方向范围（role-tiers），再结合用户可迁移能力，列 3–6 个 BOSS 搜索关键词。
- S0 →
AI内容运营AIGC运营AI标注数字人运营AI客服 - S1 →
AIGC运营AI营销Prompt工程AI设计AI视频 - S2 →
AI应用开发LLM应用大模型应用AI工程Agent开发 - S3 →
<用户行业>AIAI解决方案行业AI产品AI合规
结合用户的 transferable 能力调词，别用模板硬套。把要搜的词先念给用户确认。
Step 2 — 取真实招聘数据（BOSS adapter，human-in-the-loop）
用 ../../adapters/boss。这是半自动、需用户配合的，先把步骤告诉用户：
cd ../../adapters/boss # 相对 skill 目录；实际路径见安装位置
./launch-chrome.sh # 起【有界面】Chrome，用户扫码登录 BOSS，弹滑块手动过
node diagnose-cdp.mjs 9222 # 可选：确认当前环境能读 Chrome 调试端口
node read-boss.mjs "AIGC运营" 100010000 9222 1 # 搜词读第 1 页列表 → JSON（城市码默认全国）
node read-boss-detail.mjs 9222 "https://www.zhipin.com/job_detail/..." # 用户明确选中后，只读选中的 JD
- 每个关键词跑一次，拿回 JSON（岗位名 / 薪资量级 / 公司 / 列表页标签 / 详情链接 / diagnostics）。列表页标签通常只够判断经验/学历/实习周期，完整技能要求仍需用户手动贴 JD。
- 薪资是
▯▯-▯▯K量级（BOSS 字体混淆，adapter 不破解）——位数结构泄露量级，够区分档位；要精确值让用户手动开 2–3 个详情页看。 - JD 真实要求列表页拿不到：先看列表页筛候选，给用户 2–5 条值得看的岗位；用户明确说"读取这几个 JD"后，才用
read-boss-detail.mjs读取 1–3 个详情页。若详情读取失败，再让用户手动贴 JD。 - 若
diagnostics.maybeNeedLogin/blocked/cardCount=0：提示用户登录/过验证/重跑；选择器腐烂就把 diagnostics 发回校准。 - 若连接不上
127.0.0.1:9222：先跑node diagnose-cdp.mjs 9222。若普通终端可读但 Codex/Claude 沙箱内不可读，说明需要非沙箱权限读取本机 Chrome 调试端口，不代表 adapter 选择器坏了。 - ⚠️ 低频、只读列表页，不翻页/不进详情/不私聊（反爬风控 + ToS + 反诈 A6）。
若用户当下不方便登录跑 adapter：退而用 WebSearch 搜"<岗位> 招聘 要求 薪资 2026 / 行情报告"，但明确标注这是二手转述、不如 BOSS 一手。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 107 lines · 152 tokens per session scan A fb0259b2f3e0
skill-scan is a skill published in the GitHub repository XBuilderLAB/cheat-on-skill (196 stars, last pushed 3mo ago), licensed MIT. It adds 152 tokens to every session and 2,898 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kochab
Kochab, a personalized resume-based job-search assistant that runs a recurring scan and everything downstream of it. Use when the user wants to start or run a job search, shares a resume, or says "set up my job scan," "find roles that fit my resume," or "what should I apply to." Also use to tailor a resume, draft a…
opportunity-brief
Research a company and a specific role, then produce an honest brief on whether it is worth pursuing. Use this whenever the user mentions a recruiter reaching out, a job posting they found, a company someone told them about, or a role they are weighing. Triggers on "a recruiter contacted me," "should I apply to,"…
roadmap-interview
Run a short product-discovery interview with a user of Kochab to surface what they actually need, then turn it into structured roadmap input. Use when someone says "interview me about features," "run the roadmap interview," "I have feedback on the tool," "what should this tool do next," or when a maintainer wants to…
ai-dev-jobs-mcp
Search 8,400+ AI and ML jobs across 489 companies, inspect listings and employers, match roles, and view salary and market stats via AI Dev Jobs MCP.
resume-studio
Build, tailor, and maintain job-winning resumes with a persistent career memory. Use this skill WHENEVER the user mentions a resume or CV in any capacity — creating one, updating one, tailoring one for a job description, reviewing/critiquing one, converting a LinkedIn profile into a resume, preparing a job…
analytics-strategy
Design measurement frameworks including event taxonomy, KPI hierarchy, dashboard architecture, attribution models, and analytics implementation strategy. Use this skill whenever the user wants to plan analytics, design dashboards, build event taxonomies, define KPIs, set up tracking, or audit existing measurement.…