Borrowing it
Nothing to install: this file belongs to yangtaihong59/siyuan-plugins-mcp-sisyphus. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/yangtaihong59/siyuan-plugins-mcp-sisyphus/main/.agents/skills/siyuan-built-cjs-live-test/SKILL.mdgit clone --depth 1 https://github.com/yangtaihong59/siyuan-plugins-mcp-sisyphusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-built-cjs-live-test)<a href="https://agentmods.dev/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-built-cjs-live-test"><img src="https://agentmods.dev/badge/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-built-cjs-live-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-built-cjs-live-test"><img src="https://agentmods.dev/badge/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-built-cjs-live-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.02484 |
| Opus 5 | $0.00058 | $0.01242 |
| Sonnet 5 | $0.00023 | $0.00497 |
| Haiku 4.5 | $0.00012 | $0.00248 |
Grade A, and why
siyuan-built-cjs-live-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
使用构建产物进行真实思源验收
直接测试本轮构建出的 CJS，不用 TypeScript 源码、测试替身或陈旧的已安装产物代替。所有写入限定在用户明确指定的测试笔记本和本轮创建的隔离夹具中。
开始前读取 references/action-coverage.md。涉及严格写入时，同时读取仓库的 docs/zh/reference/write-safety.md 与 src/core/write-safety-policy.ts；后者是当前 action 分类的唯一真相源。
安全边界
- 不输出思源 Token、MCP Bearer Token、完整请求头、配置文件正文或无关笔记内容。
- 只修改测试笔记本内带本轮唯一前缀的文档、块、数据库、标签、模板和资源。
- 删除、移动、权限变更前重新解析目标 ID，并证明它属于本轮夹具；禁止用模糊路径、全局搜索结果或未解析变量做破坏性操作。
- 不调用
/api/repo/*，不为严格写入创建仓库快照。默认不实测会创建或回滚快照的 timeline action。 - 默认不执行同步、通知、反馈、第三方 extension 写入或
mascot.buy等外部副作用。只有用户单独授权且后果可接受时才执行，并将其标为“外部副作用测试”，不要宣称具备严格状态校验。 - 保留用户原有数据和代码改动。测试夹具清理失败时停止扩大清理范围，报告精确 ID 和路径。
1. 建立本轮范围
先查看 git diff --name-only、git status --short 和相关测试，列出本轮实际改动影响的工具、action、公共协调器与传输入口。
若改动触及以下任一公共文件，将 src/core/write-safety-policy.ts 中全部 mode: 'mutation' action 纳入覆盖矩阵，而不是只测改动时顺手使用的一个 action：
write-safety-*write-preflight-lease.tstool-registry.ts或server.ts的写入路由cli/write-coordinator.ts或 CLI 写入分发- 公共 API 写语义、响应精简、安全字段 schema
逐项记录 covered / blocked / intentionally excluded。存在未测试项时不得汇报“全部通过”。
2. 构建并锁定待测产物
从仓库根目录执行：
pnpm build:server
pnpm build:cli
test -s dist/mcp-server.cjs
test -s cli/dist/cli.cjs
shasum -a 256 dist/mcp-server.cjs cli/dist/cli.cjs
记录构建时间和 SHA-256，测试期间不要再次构建。生产验收使用 dist/mcp-server.cjs；只有用户明确要求开发产物时才改用 dev/mcp-server.cjs。
确认 Server bundle 没有浏览器 stdio shim：
if rg -q "StdioServerTransport is not supported in this environment" dist/mcp-server.cjs; then
echo "browser stdio shim leaked into server bundle" >&2
exit 1
fi
3. 检查真实环境
确认：
- 思源内核正在运行，并能通过现有 CLI profile 调用
system get_version。 - 严格安全写入已开启。
- 用户指定的测试笔记本存在，且 Sisyphus 对它具有
rwd权限。 - 需要测试 CLI/stdio 共享租约时，插件 HTTP MCP 服务已开启。
- 本轮测试前没有遗留的同名夹具。
只显示 profile 名、URL 主机和状态；不要打印 Token。
4. 创建隔离夹具
使用时间戳或 UUID 生成唯一前缀，例如 CJS-LIVE-20260812-213000。在测试笔记本中建立一个根测试文档，并按 action 需要创建：
- 两个可移动、重命名和删除的子文档；
- 多个段落、标题和引用块；
- 一个仅供本轮使用的属性视图及测试行列；
- 唯一测试标签；
- 唯一模板与小型测试资源；
- 可创建、复习和删除的测试闪卡；
- 必须验证 notebook 删除或权限时使用的临时测试笔记本。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 173 lines · 116 tokens per session scan A 6f70f025d714
siyuan-built-cjs-live-test is a skill published in the GitHub repository yangtaihong59/siyuan-plugins-mcp-sisyphus (104 stars, last pushed yesterday), licensed MIT. It adds 116 tokens to every session and 2,484 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.
test-warp-ui
Guides testing Warp UI features and changes using the computer use tool. Use this skill only when computer-use testing was requested (explicit request or accepted offer) and the computeruse tool is available to the agent. Covers launching Warp and verifying UI behavior.
test-electron-app
Drive the real running PostHog Electron app (live tRPC, workspace-server, real data) over CDP with agent-browser. Connect to the running app on port 9222, test desktop changes against a local Django stack, snapshot the accessibility tree, inspect network requests, and screenshot only when explicitly asked. Use when…
pyats-dynamic-test
Generate and execute deterministic pyATS aetest validation scripts - interface state, OSPF neighbors, BGP paths, ping matrices, and custom compliance tests. Use when writing a network test, validating post-change state, running pass/fail checks, or building automated regression tests.
test-loop
Plan, generate, and heal an executable E2E test suite from approved acceptance criteria (web and mobile).
playwright-cli
Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or…