Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xbuilderlab/cheat-on-skill/skill-scannpx skills add XBuilderLAB/cheat-on-skill --skill skill-scangit clone --depth 1 https://github.com/XBuilderLAB/cheat-on-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00152 | $0.02898 |
| Opus 5 | $0.00076 | $0.01449 |
| Sonnet 5 | $0.00030 | $0.00580 |
| Haiku 4.5 | $0.00015 | $0.00290 |
Grade A, and why
skill-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/skill-scan — 高薪 × 可学 × AI 增强 的交集挖掘（核心）
核心方法（先读这条）
不搜"AI 高薪职业 Top10"那类水文——它们利益不中立，是卖课/培训机构的获客漏斗。 真正诚实的需求信号是 BOSS 直聘的真实在招岗位：某岗位在招、给得起价 = 有人真在花钱买这个能力； 岗位数涨=需求升，降=红海。再叠加你的能力画像，挑出"高薪 × 你学得动 × AI 时代仍要"三个圈的交集。
铁律
- 主信源是真实招聘数据（BOSS adapter + 招聘趋势），"职业推荐"水文不作依据。
- 绝不凭记忆。薪资量级、岗位热度、技能要求一律实时取（BOSS / 网页检索加年份）。
- 每个岗位先过 AI 影响分类（
ai-impact-taxonomy.md）：替代型直接劝退，只推增强 / 新生。 - 每个岗位按用户起点算可学性（
learnability-rubric.md），低于阈值不列为首选。 - 按档位收敛（
role-tiers.md）：别给 S0 推够不着的算法岗，别给 S3 推标注。 - 任何带"培训/内推/包就业"的机会过反诈（
anti-scam-rubric.md）。 - 诚实标注 BOSS 数据边界：薪资数字被字体混淆（▯ 占位），只拿到量级；精确值要用户手动看详情页。
- 详情页只读需用户点名：只读取用户明确选择的详情链接；用户可以从候选里选任意数量，也可以少选或不选。读取时保持低频顺序执行，只提取岗位标题、公司、薪资、地点/地址、JD/要求文本；不读取/保存 HR 信息，不点"立即沟通"，不做无选择的批量抓取。
流程
Step 0 — 读上下文
- 读
.skill-state.json拿画像 +profile.start_tier（无 → 路由skill-init）。 - 读
../../shared-references/role-tiers.md（按档位分流）。 - 读
../../shared-references/ai-impact-taxonomy.md（方向闸门）。 - 读
../../shared-references/learnability-rubric.md（可学性打分）。 - 读
../../shared-references/anti-scam-rubric.md（反诈，用于培训/内推类）。 - 读
lessons.md（若存在）：用户过往复盘沉淀，优先参考。 - 任何写入
found_at/found_at_full前，先用系统时间取当前时间：
date '+%Y-%m-%d %H:%M %Z %z'
found_at 写日期，found_at_full 写具体时间和时区，跟用户系统时区走（例：2026-06-26 22:06 CST +0800）。对用户展示时写成 2026-06-26 22:06（本机时区 + UTC 偏移，如 中国标准时间 CST，UTC+8），不要写死成某个固定国家的时间。
Step 1 — 按档位锁定搜索词
先按 start_tier 限定方向范围（role-tiers），再结合用户可迁移能力，列 3–6 个 BOSS 搜索关键词。
- S0 →
AI内容运营AIGC运营AI标注数字人运营AI客服 - S1 →
AIGC运营AI营销Prompt工程AI设计AI视频 - S2 →
AI应用开发LLM应用大模型应用AI工程Agent开发 - S3 →
<用户行业>AIAI解决方案行业AI产品AI合规
结合用户的 transferable 能力调词，别用模板硬套。把要搜的词先念给用户确认。
Step 2 — 取真实招聘数据（BOSS adapter，human-in-the-loop）
用 ../../adapters/boss。这是半自动、需用户配合的，先把步骤告诉用户：
cd ../../adapters/boss # 相对 skill 目录；实际路径见安装位置
./launch-chrome.sh # 起【有界面】Chrome，用户扫码登录 BOSS，弹滑块手动过
node diagnose-cdp.mjs 9222 # 可选：确认当前环境能读 Chrome 调试端口
node read-boss.mjs "AIGC运营" 100010000 9222 1 # 搜词读第 1 页列表 → JSON（城市码默认全国）
node read-boss-detail.mjs 9222 "https://www.zhipin.com/job_detail/..." # 用户明确选中后，只读选中的 JD
- 每个关键词跑一次，拿回 JSON（岗位名 / 薪资量级 / 公司 / 列表页标签 / 详情链接 / diagnostics）。列表页标签通常只够判断经验/学历/实习周期，完整技能要求仍需用户手动贴 JD。
- 薪资是
▯▯-▯▯K量级（BOSS 字体混淆，adapter 不破解）——位数结构泄露量级，够区分档位；要精确值让用户手动开 2–3 个详情页看。 - JD 真实要求列表页拿不到：先看列表页筛候选，给用户 2–5 条值得看的岗位；用户明确说"读取这几个 JD"后，才用
read-boss-detail.mjs读取 1–3 个详情页。若详情读取失败，再让用户手动贴 JD。 - 若
diagnostics.maybeNeedLogin/blocked/cardCount=0：提示用户登录/过验证/重跑；选择器腐烂就把 diagnostics 发回校准。 - 若连接不上
127.0.0.1:9222：先跑node diagnose-cdp.mjs 9222。若普通终端可读但 Codex/Claude 沙箱内不可读，说明需要非沙箱权限读取本机 Chrome 调试端口，不代表 adapter 选择器坏了。 - ⚠️ 低频、只读列表页，不翻页/不进详情/不私聊（反爬风控 + ToS + 反诈 A6）。
若用户当下不方便登录跑 adapter：退而用 WebSearch 搜"<岗位> 招聘 要求 薪资 2026 / 行情报告"，但明确标注这是二手转述、不如 BOSS 一手。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 107 lines · 152 tokens per session scan A fb0259b2f3e0
skill-scan is a skill published in the GitHub repository XBuilderLAB/cheat-on-skill (176 stars, last pushed 2mo ago), licensed MIT. It adds 152 tokens to every session and 2,898 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
job-application-agent
Finds, evaluates, fills, submits, and tracks a candidate's own job applications using a verified resume, evidence-based targeting, secure local profile storage, and browser automation. Use for onboarding or migrating a job-search profile, searching active roles, assessing a posting, applying to an authorized URL or…
llm-intern-skill
Use when polishing, diagnosing, tailoring, or exporting resumes for LLM, RAG, Agent, Agentic RL, post-training, pretraining, AIGC, search/ranking, multimodal, AI backend, or LLM algorithm internships from raw resume text, a materials folder, and/or a target job description. Audits evidence, maps JD fit, enforces truth…
autopilot-jobhunt
Run a job hunt in one agentic pass — scan configured company careers pages, score postings against the user's resume, draft a tailored resume + cover letter per chosen role (never applies), and export matches. Trigger when the user says /autopilot-jobhunt or asks to scan/find jobs or draft an application.
pilot
One autonomous Pilot cycle - fetch the agenda, execute the top item, journal, exit. Injected by the terminal host - not for manual invocation loops.
apply
Apply to a single job (URL or pasted page) with fit review, or score and apply the job links pasted into an apply campaign when no argument is given.
tailor-resume
Choose the best existing resume base/variant for a job, or create a new tailored variant when nothing fits.