Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add YunYouJun/advjs --skill adv-hamster-demogit clone --depth 1 https://github.com/YunYouJun/advjsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yunyoujun/advjs/adv-hamster-demo)<a href="https://agentmods.dev/skills/yunyoujun/advjs/adv-hamster-demo"><img src="https://agentmods.dev/badge/skills/yunyoujun/advjs/adv-hamster-demo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yunyoujun/advjs/adv-hamster-demo"><img src="https://agentmods.dev/badge/skills/yunyoujun/advjs/adv-hamster-demo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.00560 |
| Opus 5 | $0.00034 | $0.00280 |
| Sonnet 5 | $0.00014 | $0.00112 |
| Haiku 4.5 | $0.00007 | $0.00056 |
Grade A, and why
adv-hamster-demo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 29 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ADV Hamster Demo
Apply the fixed decisions for demo/hamster without leaking game-specific constants into reusable ADV.JS workflows.
Required procedure
- Read references/demo-contract.md completely before changing story, characters, scenes, images, audio, configuration, or deployment paths.
- Use
adv-adaptfor source coverage, author-metadata separation, source anchors, cast/scene inventories, and the scene-by-scene staging table. - Use
adv-artfor the art bible, connected-region keying, five-background alpha QA, expression/CG/background contact sheets, sprite validation, asset manifest, and release audit. - Use
tencent-cloud-cosonly for credential-safe COS inspection and publication. - Run
adv-debugfor structural facts, then useadv-reviewfor chapter-level fidelity before browser playtesting. - Run deterministic audits and browser playtesting before calling the demo complete.
Fixed boundaries
- The playable story is one seamless 16-chapter route. Do not show source division, forewords, postscripts, author notes, adaptation labels, “A+”, or “canon” terminology in the title, chapter map, HUD, or dialogue.
- Source author/title/links appear only in the About page and license documentation. Internal traceability remains in
adv/adaptation.jsonand source comments. - “回声演算” is a world-internal postgame route and is hidden until completion persists.
- The public asset root is
https://cos.advjs.yunle.fun/games/hamster/v1/. - The heroine/observer never wears glasses. The assistant/reader also does not require glasses. Preserve each character's approved outfit and silhouette across expressions and CGs.
- Ship 8 stable-ID CGs, 8 reusable loopable BGM motifs, 15 reusable backgrounds, 28 standing variants, and the hamster's six-frame running spritesheet unless the contract is deliberately versioned.
- 禁止把任何 COS 凭证、临时令牌或私有源文件写入仓库。禁止在配置中使用
latest/或覆盖已经按 immutable 缓存发布的对象。 - Keep generic adaptation, image-generation, runtime, and COS instructions in their owning Skills; this Skill stores only demo-specific paths and acceptance gates.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 29 lines · 68 tokens per session scan A 4dea28fd67c7
adv-hamster-demo is a skill published in the GitHub repository YunYouJun/advjs (325 stars, last pushed 21d ago), licensed MPL-2.0. It adds 68 tokens to every session and 560 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
anti-cheat-systems
Analyze layered game integrity defenses and select repository resources for process-memory reports, acquired-memory forensics, callback scope, behavioral measurement and driver-policy evidence. Use for DMA versus host-mediated acquisition, input provenance, replay fidelity, collector health, detector rollout/recovery…
game-hacking-techniques
Classify game-cheating threats across client memory, code injection, rendering, input, engines, kernels, DMA and remote transports. Use for repository-backed attack-surface maps, attacker prerequisites, state exposure, legitimate comparison baselines, and observable artifacts. Select engine source, capture or…
windows-kernel-security
Analyze Windows driver trust boundaries and kernel evidence for game-security research. Use for IOCTL authorization, callbacks and IRQL, driver provenance, DSE/PatchGuard, VBS/HVCI, build-specific internals, and crash or memory forensics; select repository resources for symbol comparison, ETW metadata, driver-unit…
graphics-api-hooking
Analyze Direct3D/DXGI, OpenGL, and Vulkan rendering, presentation, composition, and capture evidence. Use to distinguish API samples, PresentMon event metrics, Tracy instrumentation, compatibility translation, frame images, and validation diagnostics; review swap chains, overlays, resource lifetime, and…
reverse-engineering-tools
Investigate supplied game binaries, protection components, drivers, dumps, and traces through reproducible binary analysis. Use for repository resource selection, PE/symbol inspection, disassembly and decompilation, control/data-flow reconstruction, build comparison, obfuscation classification, and interface evidence…
game-engine-resources
Analyze Unreal, Unity, Source, Godot, and custom engine trust boundaries and select matching repository resources. Use for engine/build identification, full source versus C# reference subsets, version-matched demos, editor versus shipped plugins, reflection and object lifecycles, Mono/IL2CPP, asset schemas, and…