Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yan-labs/yan-skills --skill rankupgit clone --depth 1 https://github.com/yan-labs/yan-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yan-labs/yan-skills/rankup)<a href="https://agentmods.dev/skills/yan-labs/yan-skills/rankup"><img src="https://agentmods.dev/badge/skills/yan-labs/yan-skills/rankup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yan-labs/yan-skills/rankup"><img src="https://agentmods.dev/badge/skills/yan-labs/yan-skills/rankup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 65 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 150 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 262 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 265 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 266 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 267 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00353 | $0.09946 |
| Opus 5.5 | $0.00141 | $0.03978 |
| Sonnet 5.5 | $0.00071 | $0.01989 |
| Haiku 4.5 | $0.00035 | $0.00995 |
Grade A, and why
rankup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rankup
Rankup 是独立开发者的项目全生命周期管理 Skill：调研与需求验证 → 立项与定位 → 建站或做原生 App（macOS、iOS、iPad；不做 Android App，Android 商店只作需求参考）→ 上线前 SEO / GEO → 上线与接入 → 外链获客 → 变现与监控迭代。
SEO 与 GEO 是最主要的获客与验证手段，不是适用边界：项目计划、交接文档、功能迭代、上线运维、项目记录整理都归这里。
每个项目的 .rankup/ 记录长远规划与当前进展，负责跨会话接力；本文件只做入口与路由，细节在 references/，一次任务只读需要的那部分。
取不到的数据写「未知 / 不可用」，不写 0；区分「官方要求」「工具建议」「项目经验」；阶段性汇报不等于完成。
强制流程（先读这张表，再做任何事）
项目任务按下表读取相关入口与接力，再选择任务分支，避免依据过期印象执行；纯只读与轻量任务按对应例外执行。 需要登录态的验收先按测试身份与登录通路复用已有身份、自查通路并遵守测试边界。
| 触发条件 | 必须先读 | 必须做 | 完成标志 |
|---|---|---|---|
| 开工：项目任务（含工作区根） | 接力协议、项目接力记录 | 按接力与下文启动协议恢复、对账和记录状态 | 接力可续做 |
| 里程碑：产物、决定或后台任务状态变化 | 同上接力协议 | 覆盖当前接力与产物指针 | 接力反映最新状态 |
| 收尾：完成、放弃、叫停或等用户决定 | 维护「一」「二」 | 按轻量路径或五步维护收口；扫描用 scripts/maintain/ref-scan.mjs |
回复有维护摘要与证据 |
| 有项目记录上下文的「继续」「接着做」「上次做到哪」「我们开始执行这个项目的计划」，或读计划 / 交接 / 进度文档 | 同上「新会话怎么接」 | 定位项目 → 读接力（无 .rankup/ 用 HANDOFF.md）→ 核对后台产物与改动 → 直接执行下一步 |
下一步已有执行证据 |
| 选词、调研、找需求（已有主词） | playbooks/entry.md → research.md |
按入口四步顺序与两路判读执行；方向未落主词先走 selection.md，无方向先走 P1，主词出现后回本行 |
入口卡写进 .rankup/research/<词根>-<日期>.md |
| ChatGPT 问法链路、自然推荐验证 | seo-geo.md 步骤 2–3 |
问法、采样、追问与三清单只按该唯一源；词级编排与裁决回 entry.md |
入口卡②有三清单与原始证据指针 |
| 「谷歌质量」「HCU」「E-E-A-T」「AI 内容会不会被打」「内容 review」「垃圾内容政策」 | seo-helpful-content.md |
区分官方口径与业内推断；按单页或站点级自检表核对并留证据 | 对应自检表通过且无红线 |
| 建站、做功能、写 UI | lifecycle/stage-3-build.md、cloudflare-stack.md |
用用户指定模板，未指定则用默认 shadcn 命令；UI 来自组件库，不手写基础控件；当天过完 Day-1 清单；核建设中红线 | checklists.md 段 3 通过 |
| 写页面内容、写文章、写 blog、model 页面、模型对比、产品对比、补参考视频、封面图 | blog（blog/SKILL.md） |
按其分工与流程执行（X 调研交 Grok、成文交 Gemini、review 交 Sonnet），不自己编内容；站内英文页面内容一律走 /blog |
sources、成文、review、评判（哥飞评分、AITDK、ChatGPT 匿名问答）、回读证据齐全 |
| 做内页、「把这个词做成页面」 | lifecycle/stage-4-prelaunch.md「新增内页随手清单」 |
页面映射按 段 2 §2.3；目标词登记到 keywords.md；按段 4 完成页面与体检；核建设中红线 |
checks.md 记 ✅ 与证据 |
| 上线前体检、「能不能上线」 | checklists.md 段 4、lifecycle/stage-4-prelaunch.md |
全套体检：AITDK、PageSpeed、图标专项、占位专项；重跑不采信上一轮；核建设中红线 | 段 4 闸门全绿，或写明改不动的理由 |
| 接入、绑域名、提交 sitemap、「怎么不收录」 | lifecycle/stage-5-launch.md、search-platforms.md |
先 site-onboard.mjs --check 再执行；接入一律线上实测 |
.rankup/integrations.md 逐行有证据与日期 |
| 外链 | backlink Skill、lifecycle/stage-6-backlinks.md |
Rankup 只判时机与数量；提交前把候选清单给用户圈定 | 台账有 submitted → public → indexed 证据 |
| 变现、支付、定价 | monetization.md、lifecycle/stage-7-monetize.md |
按分发方式选主通道与备份，目标环境端到端验证 | 验证记录进 .rankup/integrations.md |
| 维护 Skill 本身：改 rankup 源码，或「把这个经验写进 rankup」 | maintenance.md「五」、evolution.md |
全量扫描后改；拆移文档用 scripts/maintain/split-doc.mjs；scripts/maintain/doc-lint.mjs 断链为 0；validate 与相关测试通过；按规则升版本 |
node scripts/validate-rankup.mjs 通过 |
「/rankup doctor」「doctor」（整理项目 .rankup/ 记录）、「整理一下项目记录」「.rankup 太乱了」「整理一下 rankup」「把这个项目的 .rankup 重新整理」 |
maintenance.md「六」、project-memory.md 目录规范 |
免版本更新与线上对账；rankup-doctor.mjs 只读诊断 → 经验分拣与回流（按四层归属逐条判去向）→ 分三类出计划 → 执行 A、B → 回读校验；C 类与别的 Skill 的经验只列给用户 |
整理报告：改了、删了（从哪找回）、留了、经验分拣表、待用户决定 |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 421 B
- data/provider-capabilities.json 226 KB
- data/word-roots.json 17 KB
- evals/evals.json 2.5 KB
- evals/trigger-evals.json 2.4 KB
- references/analytics-platforms.md 24 KB
- references/capability-map.md 42 KB
- references/checklists.md 65 KB
- references/cloudflare-stack.md 37 KB
- references/cloudflare/deploy.md 12 KB
- references/cloudflare/domain-email.md 21 KB
- references/demand-sources.md 18 KB
- references/demand-sources/competitors-and-roots.md 17 KB
- references/demand-sources/revenue-and-ads.md 10 KB
- references/demand-sources/users-and-launches.md 23 KB
- references/demand-sources/validation-chain.md 22 KB
- references/design-references.md 14 KB
- references/discipline.md 62 KB
- references/discipline/browser-rendering.md 3.1 KB
- references/evolution.md 25 KB
- references/experiences/conversion.md 16 KB
- references/experiences/demand-discovery-sources.md 11 KB
- references/experiences/demand-discovery.md 28 KB
- references/experiences/demand-judgment.md 15 KB
- references/experiences/INDEX.md 6.5 KB
- references/experiences/webcafe-experiences-2.md 23 KB
- references/experiences/webcafe-experiences.md 19 KB
- references/experiences/webcafe-topics.md 38 KB
- references/experiences/zero-to-one.md 14 KB
- references/game-sites.md 20 KB
- references/integrations.md 29 KB
- references/integrations/browser-data.md 18 KB
- references/integrations/kie-models.md 6.4 KB
- references/integrations/kie.md 12 KB
- references/lifecycle.md 9.4 KB
- references/lifecycle/stage-1-research.md 5.3 KB
- references/lifecycle/stage-2-positioning.md 11 KB
- references/lifecycle/stage-3-build.md 37 KB
- references/lifecycle/stage-4-prelaunch.md 36 KB
- references/lifecycle/stage-5-launch.md 35 KB
- references/lifecycle/stage-6-backlinks.md 9.3 KB
- references/lifecycle/stage-7-monetize.md 12 KB
- references/maintenance.md 24 KB
- references/monetization.md 14 KB
- references/payments-anyway.md 9.9 KB
- references/playbooks/entry.md 8.3 KB
- references/playbooks/INDEX.md 6.6 KB
- references/playbooks/research.md 29 KB
- references/playbooks/research/p1-discovery.md 9.8 KB
- references/playbooks/research/p2-keyword-root.md 24 KB
- references/playbooks/selection.md 13 KB
- references/playbooks/selection/gates.md 25 KB
- references/playbooks/selection/generator.md 10 KB
- references/playbooks/site-review.md 46 KB
- references/product-launch.md 12 KB
- references/project-memory.md 40 KB
- references/provider-capabilities.md 50 KB
- references/provider-capabilities/dom-probe-audit-2026-08-29.md 21 KB
- references/provider-capabilities/semrush.md 18 KB
- references/provider-capabilities/similarweb.md 17 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +1 lines c98fa80a420d
- 21d ago Changed · +3 lines d4c20901ed7d
- 22d ago Changed 30e45d9963f7
- 28d ago Changed · +1 lines 25801ab4aaa4
- 29d ago Changed · +2 lines 30d979ee507c
- 1mo ago Changed 0f14f1112bd7
- 1mo ago Changed · +1 lines 15a781015bd9
- 1mo ago Changed 8a14fbda6b2c
- 1mo ago Changed · -136 lines · +228 tokens per session aaf31f8e1ec2
- 1mo ago First seen · 342 lines · 125 tokens per session scan A 24b29bdb9c87
rankup is a skill published in the GitHub repository yan-labs/yan-skills (228 stars, last pushed 2d ago), licensed MIT. It adds 353 tokens to every session and 9,946 once invoked, about $0.0014 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
seo-mastery-jp
A Japanese-language SEO skill covering search visibility, website structure, page content, structured data, performance metrics, AI search, Astro, and Cloudflare edge deployments.
seo-mastery
Evidence-based SEO and generative search visibility: technical/content SEO, schema.org / JSON-LD, Core Web Vitals, E-E-A-T, Astro, Cloudflare Workers/Pages, and audits. Use for SEO, robots.txt, sitemaps, canonical, hreflang, meta tags, LCP/INP/CLS, GEO (Generative Engine Optimization), LLMO (Large Language Model…
youtube-comment-management
Lister, modérer et répondre aux commentaires de chaînes YouTube via l'API v3, avec maillage SEO vers vos sites WordPress.
alternatives-pages
Create "[Competitor] alternative" and comparison pages for developer tools. Build honest, high-converting comparison content that ranks for competitive search terms.
analytics-tracking
Design, audit, and improve analytics tracking systems that produce reliable, decision-ready data.
loki-yan-seo
Use when diagnosing or executing Google SEO, international/cross-border sites, AIO, or GEO. Unofficial engine distilled from Loki Yan (@lokiyanseo) public tweets. Not a generic SEO encyclopedia. Does not imitate his voice. Not affiliated or endorsed.