Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xiaotonng/pikiloom/auto-promote)<a href="https://agentmods.dev/skills/xiaotonng/pikiloom/auto-promote"><img src="https://agentmods.dev/badge/skills/xiaotonng/pikiloom/auto-promote/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xiaotonng/pikiloom/auto-promote"><img src="https://agentmods.dev/badge/skills/xiaotonng/pikiloom/auto-promote.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.01058 |
| Opus 5 | $0.00046 | $0.00529 |
| Sonnet 5 | $0.00018 | $0.00212 |
| Haiku 4.5 | $0.00009 | $0.00106 |
Grade A, and why
auto-promote scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Auto-Promote — 无人值守推广总入口
跨三渠道跑一轮完整推广,严格执行 ../_promo/orchestrate.md。
这是给每日 cron 调用的单一入口;也可手动跑。所有话术来自 _promo/pitch.md,去重/护栏/度量来自共享核心。
运行根目录:
cd /Users/admin/Desktop/project/pikiloom。
参数
- (空) → 完整一轮:Phase 0→5,所有
enabled且有剩余配额的渠道。 post-approved→ 只执行 orchestrate.md Phase 4 的「发 batch 待发队列」:发registry.py pending里status=approved、drafted_at早于veto_window_hours、不在abort.txt、且重新guard.py check通过的记录。 (batchposture 下,由 veto 窗口之后的第二个 cron 调用。)channel:<github|twitter|reddit>→ 只跑该渠道。shadow→ 本轮强制 shadow(不发,只预览),无视 config 的 posture。
执行
- 读 orchestrate.md 并逐 Phase 执行。 不要在这里重述流程 —— orchestrate.md 是唯一权威 runbook。
- Phase 0 预检:先
measure.py pull;读config.json的kill_switch/posture;guard.py caps看各渠道剩余配额。kill_switch=true→ 推一张「已停(kill switch)」卡片并结束。 - 每个渠道的发现/抽取/发布机制委托给对应渠道 SKILL(
promote/snipe/reddit-snipe), 本入口只负责按 orchestrate.md 的跨渠道契约串起来(去重 → 起草 → 批判 → 护栏 → posture 发布 → 记录)。 - 起草与批判用子 agent(话术契约 =
pitch.md)。发布前必过guard.py check(exit 3 = 跳过)。 - 收尾:
registry.py stats+measure.py report,把本轮 posted/skipped/failed 计数 + 度量推飞书。
安全契约(硬性)
- 发布的唯一开关是
config.json.posture;绝不在本 skill 里硬编码绕过 posture / 护栏 / 去重。 - 一切发布前都经过
guard.py(频次、每仓/每 sub 上限、变体、熔断、kill_switch、abort.txt)。 - 失败(发帖报错 / 校验异常)记
status=failed并继续下一条,绝不中断整轮。 - GitHub 用
gh issue comment最稳,建议auto从 github 渠道先开;Twitter/Reddit 走浏览器,稳定后再开。
调度(每日)
schedule技能:建一个每日 routine 跑/auto-promote;batchposture 再加一个veto_window_hours之后的 routine 跑/auto-promote post-approved。loop技能:按天loop/auto-promote(每轮先发上一轮的 approved 队列,再起草新一轮)。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 47 lines · 91 tokens per session scan A a982a94fc610
auto-promote is a skill published in the GitHub repository xiaotonng/pikiloom (294 stars, last pushed yesterday), licensed MIT. It adds 91 tokens to every session and 1,058 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
torch-geometric
Graph Neural Networks (PyG). Node/graph classification, link prediction, GCN, GAT, GraphSAGE, heterogeneous graphs, molecular property prediction, for geometric deep learning.
shap
Model interpretability and explainability using SHAP (SHapley Additive exPlanations). Use this skill when explaining machine learning model predictions, computing feature importance, generating SHAP plots (waterfall, beeswarm, bar, scatter, force, heatmap), debugging models, analyzing model bias or fairness, comparing…
rowan
Cloud-based quantum chemistry platform with Python API. Preferred for computational chemistry workflows including pKa prediction, geometry optimization, conformer searching, molecular property calculations, protein-ligand docking (AutoDock Vina), and AI protein cofolding (Chai-1, Boltz-1/2). Use when tasks involve…
arboreto
Infer gene regulatory networks (GRNs) from gene expression data using scalable algorithms (GRNBoost2, GENIE3). Use when analyzing transcriptomics data (bulk RNA-seq, single-cell RNA-seq) to identify transcription factor-target gene relationships and regulatory interactions. Supports distributed computation for…
denario
Multiagent AI system for scientific research assistance that automates research workflows from data analysis to publication. This skill should be used when generating research ideas from datasets, developing research methodologies, executing computational experiments, performing literature searches, or generating…
context-recovery
Recovers project handoff context from local Codex, Claude Code, Gemini, CodeBuddy, and codexmate-derived sessions. Use when the user asks what happened in prior project/PR/branch/file/error work, needs a handoff brief, wants old decisions or validations recovered, or asks to summarize cross-session project activity…