Borrowing it
Nothing to install: this file belongs to yangtaihong59/siyuan-plugins-mcp-sisyphus. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/yangtaihong59/siyuan-plugins-mcp-sisyphus/main/.agents/skills/siyuan-chatgpt-secure-tunnel/SKILL.mdgit clone --depth 1 https://github.com/yangtaihong59/siyuan-plugins-mcp-sisyphusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-chatgpt-secure-tunnel)<a href="https://agentmods.dev/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-chatgpt-secure-tunnel"><img src="https://agentmods.dev/badge/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-chatgpt-secure-tunnel/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-chatgpt-secure-tunnel"><img src="https://agentmods.dev/badge/skills/yangtaihong59/siyuan-plugins-mcp-sisyphus/siyuan-chatgpt-secure-tunnel.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 26 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 30 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 91 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 93 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 112 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 119 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00184 | $0.02557 |
| Opus 5 | $0.00092 | $0.01278 |
| Sonnet 5 | $0.00037 | $0.00511 |
| Haiku 4.5 | $0.00018 | $0.00256 |
Grade A, and why
siyuan-chatgpt-secure-tunnel scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
配置思源 ChatGPT 安全隧道
先下载、安装并启用 SiYuan Sisyphus，再把以下链路配置为可恢复、可诊断、开机自动运行的长期连接：
ChatGPT 网页端 → OpenAI Secure MCP Tunnel → 本机 tunnel-client → 思源 MCP stdio Server → 本地思源内核
直接执行配置、诊断和只读验证。不要只给操作说明。开始前完整读取 references/runbook.md，并以执行时获取的 OpenAI 官方文档和本机实际状态为准。
把 Sisyphus 视为强制前置依赖
- 不要把 tunnel 直接指向裸思源内核。Tunnel 的本地 MCP Server 必须是 SiYuan Sisyphus 提供的
mcp-server.cjs。 - 先确认插件清单名为
siyuan-plugins-mcp-sisyphus，插件已启用，且插件目录同时存在有效的plugin.json与mcp-server.cjs。 - 插件缺失时，优先在思源集市搜索
SiYuan Sisyphus并安装；集市不可用时，才从项目官方 GitHub Release 下载最新正式版package.zip。不要从第三方镜像下载。 - 安装或升级后，打开
插件 → SiYuan Sisyphus MCP & CLI → 设置，至少为端到端验证所需笔记本配置只读权限并保存。插件未启用、设置未初始化或权限文件未就绪时，不要继续创建 tunnel profile。 - 若单独复制或解压
mcp-server.cjs，确保它与当前安装的 Sisyphus 插件来自同一 release；插件升级后同步更新，避免客户端 Server 与插件版本漂移。
严守安全边界
- 只使用 OpenAI 官方 Secure MCP Tunnel。不要改用 ngrok、Cloudflare Quick Tunnel、端口转发或其他公网暴露方案。
- 这条链路只用于 ChatGPT 开发者模式下的私有连接。配置过程中不要发布思源插件、npm 包或公开连接，也不要创建 tag、GitHub Release 或集市发布产物。
- 不在回复、工具参数、命令行参数、脚本、plist、Git、日志、截图、剪贴板历史或临时明文文件中展示或保存任何密钥。
- 把 OpenAI Runtime API Key 和思源内核 API Token 分别保存到 macOS 钥匙串。需要录入密钥时，让用户直接在隐藏输入提示或钥匙串界面中完成；不要让用户把密钥发到聊天里。
- 区分两种思源 Token：stdio MCP 的
SIYUAN_TOKEN必须来自工作空间conf/conf.json的.api.token；不要使用插件mcpHttpSettings中的 MCP HTTP Bearer Token。 - 不创建、更新、移动、删除或覆盖任何思源文档、块、数据库、资源、标签、闪卡或笔记本。验证只调用只读 action。
- 不删除现有 tunnel、ChatGPT 插件、钥匙串项目或用户配置。优先复用并修复；覆盖脚本、profile 或 plist 前先读取、比对并保留可恢复备份。
- 如果缺少 Platform Tunnel 权限、目标 ChatGPT workspace 关联、开发者模式、登录、验证码或系统授权，停在对应页面，只说明用户需要完成的单一动作；完成后从当前步骤继续。
- 写入
~/.local、~/Library/LaunchAgents、钥匙串或 Platform/ChatGPT 账号属于预期配置动作，但仍须遵守当前执行环境的审批机制。
按阶段执行
1. 下载、安装并启用 SiYuan Sisyphus
检查思源集市或工作空间插件目录。已安装时复用并核对版本、启用状态、设置和权限；未安装时完成下载、安装和启用。只有以下条件全部满足才继续：
/data/plugins/siyuan-plugins-mcp-sisyphus/plugin.json可读，且name正确；- 本机可执行路径下存在同版本
mcp-server.cjs； - 插件设置面板已至少打开并保存一次；
- 端到端只读测试所需的笔记本权限已配置；
- 重启或重载插件后，思源内核仍可访问。
2. 建立事实基线
先做只读检查，记录但不要泄露敏感值：
- macOS 架构、当前用户、Node.js 绝对路径；
- 思源桌面端、
127.0.0.1:6806、真实工作空间路径； - Sisyphus 的安装来源、版本、启用状态、权限就绪状态，以及
mcp-server.cjs的真实路径； tunnel-client、siyuan-webprofile、LaunchAgent 和健康端点是否已经存在；- 本机能否出站访问
api.openai.com:443（启用 control-plane mTLS 时还要检查mtls.api.openai.com:443），以及本地 Sisyphus stdio MCP 是否可启动； - Platform 是否已有名称包含
SiYuan或思源的 tunnel； - ChatGPT 是否已有绑定同一 tunnel 的思源插件。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 122 lines · 184 tokens per session scan A 0c51c70bb798
siyuan-chatgpt-secure-tunnel is a skill published in the GitHub repository yangtaihong59/siyuan-plugins-mcp-sisyphus (104 stars, last pushed 2d ago), licensed MIT. It adds 184 tokens to every session and 2,557 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
media-ingest
Ingest video, audio, PDF, book, screenshot, and GitHub repo content into the brain. Multi-format handling with entity extraction and backlink propagation. Covers video-ingest, youtube-ingest, and book-ingest subtypes.
mem0-oss-to-platform
Plan and then execute a migration of a project from the mem0 open-source / self-hosted SDK (the local Memory class) to the mem0 Platform / hosted / managed SDK (the MemoryClient class). Use this whenever a developer wants to move, switch, or migrate their mem0 usage off OSS/self-hosted to the hosted API — e.g.…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
memory
Use when the user asks to remember, recall, forget, update, search, or inspect durable OpenSquilla memory, including profile facts in USER.md and long-term notes in MEMORY.md or memory//.md.
ha-data-stores
Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…
establishing-project-context
Use when the user asks to establish shared project language, or project work exposes a conflicting, renamed, or deprecated domain term that needs active semantic modeling. Routine small tasks stay on the fast path.