Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yan-labs/yan-skills --skill skillsmpgit clone --depth 1 https://github.com/yan-labs/yan-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yan-labs/yan-skills/skillsmp)<a href="https://agentmods.dev/skills/yan-labs/yan-skills/skillsmp"><img src="https://agentmods.dev/badge/skills/yan-labs/yan-skills/skillsmp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yan-labs/yan-skills/skillsmp"><img src="https://agentmods.dev/badge/skills/yan-labs/yan-skills/skillsmp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 36 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 54 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00192 | $0.02749 |
| Opus 5 | $0.00096 | $0.01375 |
| Sonnet 5 | $0.00038 | $0.00550 |
| Haiku 4.5 | $0.00019 | $0.00275 |
Grade A, and why
skillsmp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SkillsMP
搜 SkillsMP —— 目前最大的公开 Agent Skill 索引（1.6M+ 个 SKILL.md，来自 GitHub，覆盖 Claude Code、Codex、ChatGPT）。
要动手写一个新 Skill 之前，先来这里搜一遍。 别人写过的概率比你以为的高。
一句话 → 用哪个能力
用户不会说「跑 treasure.mjs --pages 5」。他会说下面左边那些话。
| 用户大概会这么说 | 从这里开始 |
|---|---|
| 「有没有现成的 skill 能做 X」「找个 skill」 | node scripts/search.mjs "X" --limit 20。命中少就换个说法再搜一次，别断言「不存在」 |
| 「我想写个做 X 的 skill」（动手前必答） | 先 search.mjs "X"，看有没有人写过。这是本 Skill 存在的第一个理由 |
| 「这个领域已经有哪些 skill 了」「盘一下现状」 | node scripts/search.mjs "领域词" --pages 3 --json，存本地再过滤，别反复重搜（配额按天算） |
| 「找点好东西」「有没有小众但写得好的」「挖宝」 | node scripts/treasure.mjs "关键词" --pages 5 --top 15。它出全量候选 + 原始信号，sortKey 只是排序键、不是评分，也不替你丢行 |
| 「按星数给我排一下」 | 可以，但先读下面那条坑：stars 是仓库星数，不是这个 Skill 的。treasure.mjs --sort stars 换排法用的是同一批候选 |
| 「太多了，把大厂仓库的过滤掉」 | --max-stars N。没有默认值：不给就一条不过滤；给了也只标 aboveMaxStars 折叠，不删行，--json 里照样全在 |
| 「只要中文的 / 只要 DevOps 的 / 只要给开发看的」 | --lang zh · --category devops · --occupation software-developers |
| 「搜出来只有 5 个？」 | 那是 pagination.total 在骗人（totalIsExact:false，严重偏低）。翻页只认 hasNext |
| 「这个 skill 到底行不行」 | 打开它的 githubUrl 读一眼再下结论。description 是作者的营销文案，不是验证过的能力 |
它不做的事：装 Skill、写 Skill、评审 Skill 质量。它只把候选摆到你眼前。
目录
skillsmp/
├── SKILL.md ← 你在这里：怎么搜、怎么挖宝、两个必须知道的坑
├── .env.example ← 复制成 .env 填 API Key（可选；.env 已被忽略，绝不提交）
└── scripts/
├── search.mjs 直搜。可翻页、可按分类/职业/语言过滤，可 --json
└── treasure.mjs ★ 挖宝。故意不按星数排，理由见下。出全量候选 + 原始信号，
排序键只是排序键，不丢行也不下判决
先跑起来
不需要任何配置——匿名就能用（50 次/天、10 次/分钟）：
node scripts/search.mjs "关键词" --limit 20
想要 500 次/天，就配一个 Key：
cp .env.example .env # 然后把 Key 填进去
Key 从 https://skillsmp.com/docs/api 生成。它是凭据，只放 .env，绝不进仓库
（仓库的 .gitignore 已经拦了 */.env，别绕过它）。
两个必须知道的坑
★ 不是这个 Skill 的星数，是它所在仓库的星数
这是本 Skill 存在的主要理由。API 返回的 stars 是包含该 Skill 的 GitHub 仓库
的星数。实测：某条结果报 240467，而它所在仓库的真实星数是 240743 —— 对得上，确认无疑。
后果很实际：
- 一个塞在超高星仓库里的 Skill（哪怕只是整包机翻的文档）自动继承那个星数；
- 一个作者单独开仓库、认真写的单一用途 Skill，只有个位数星。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 152 lines · 192 tokens per session scan A 34e53a995ee2
skillsmp is a skill published in the GitHub repository yan-labs/yan-skills (183 stars, last pushed yesterday), licensed MIT. It adds 192 tokens to every session and 2,749 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
seo-mastery-jp
A Japanese-language SEO skill covering search visibility, website structure, page content, structured data, performance metrics, AI search, Astro, and Cloudflare edge deployments.
seo-mastery
Evidence-based SEO and generative search visibility: technical/content SEO, schema.org / JSON-LD, Core Web Vitals, E-E-A-T, Astro, Cloudflare Workers/Pages, and audits. Use for SEO, robots.txt, sitemaps, canonical, hreflang, meta tags, LCP/INP/CLS, GEO (Generative Engine Optimization), LLMO (Large Language Model…
alternatives-pages
Create "[Competitor] alternative" and comparison pages for developer tools. Build honest, high-converting comparison content that ranks for competitive search terms.
analytics-tracking
Design, audit, and improve analytics tracking systems that produce reliable, decision-ready data.
loki-yan-seo
Use when diagnosing or executing Google SEO, international/cross-border sites, AIO, or GEO. Unofficial engine distilled from Loki Yan (@lokiyanseo) public tweets. Not a generic SEO encyclopedia. Does not imitate his voice. Not affiliated or endorsed.
youtube-comment-management
Lister, modérer et répondre aux commentaires de chaînes YouTube via l'API v3, avec maillage SEO vers vos sites WordPress.