Borrowing it
Nothing to install: this file belongs to zhinjs/zhin. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhinjs/zhin/main/.github/skills/migrate-zhin-plugin-runtime/SKILL.mdgit clone --depth 1 https://github.com/zhinjs/zhinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhinjs/zhin/migrate-zhin-plugin-runtime)<a href="https://agentmods.dev/skills/zhinjs/zhin/migrate-zhin-plugin-runtime"><img src="https://agentmods.dev/badge/skills/zhinjs/zhin/migrate-zhin-plugin-runtime.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00178 | $0.02415 |
| Opus 5 | $0.00089 | $0.01208 |
| Sonnet 5 | $0.00036 | $0.00483 |
| Haiku 4.5 | $0.00018 | $0.00242 |
Grade A, and why
migrate-zhin-plugin-runtime scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
迁移 Zhin Plugin Runtime
目标是产出纯新架构代码：plugin.ts 只做装配，能力按目录发现，共享状态走 Resource/Token。
不保留 compat runtime，不双写。
先建立事实，再动手
迁移最容易翻车的地方是凭印象改代码。zhin runtime migrate status 会静态分析整个项目并
返回一个状态机，它比任何猜测都准 —— 每一步都以它的输出为准：
zhin runtime migrate status # 输出 JSON；state 为 ready 时退出码 0，否则 1
| state | 含义 | 下一步 |
|---|---|---|
blocked |
有 error 或 manual 诊断，自动迁移无法证明语义等价 |
人工清掉诊断，见 人工诊断处理 |
extraction-required |
还有能自动搬运的注册（automatic > 0） |
zhin runtime migrate extract --write |
cutover-required |
能力已就位，但 package.json#zhin / plugin.ts 还没生成 |
zhin runtime migrate cutover --write |
dual-run |
仍在从 zhin.js 导入经典 API（usePlugin / MessageCommand 等），或直接 import @zhin.js/core / @zhin.js/kernel |
改用门面约定 API（definePlugin / defineCommand 等），删掉旧入口 |
compat |
仍在 import @zhin.js/next-compat |
移除 compat 依赖 |
ready |
完成 | 跑构建与测试 |
状态是从上往下判定的：只要还有 manual/error 诊断就一直是 blocked，先清诊断再谈其它。
工作流
- 盘点：读目标包的 README、最近的测试、旧入口，弄清用户可见行为（命令、消息、定时、 持久化）。迁移的验收标准是行为不变，不是编译通过。
- 看计划：
zhin runtime migrate extract --check，逐条读changes与diagnostics。--check与--write必须二选一，同时给或都不给会直接报错。 - 搬能力：
zhin runtime migrate extract --write。它只搬模块顶层、且闭包干净的注册， 已存在的目标文件不会被覆盖。 - 清诊断：每条
manual都要人工处理，见 人工诊断处理。 最常见的是 action 捕获了模块级变量 —— 把它提升为 owner Resource，能力文件再从执行上下文读。 - 装配：
zhin runtime migrate cutover --write生成package.json#zhin与plugin.ts， 并补齐zhin.js、@zhin.js/runtime；Stable Features 可由 Root 继承，不必再装@zhin.js/command|middleware|component（cutover 仍可能按约定目录写入 features 挂载）。启动脚本统一是zhin runtime start，不要再写失效的zhin dev/zhin start/zhin build。package.json#private: true的本地 TS root 使用entry: "./plugin.ts"，直接执行pnpm dev或zhin runtime start。- 非 private 的发布包使用
entry: "./plugin.js"；cutover 生成独立的tsconfig.zhin.json、zhin:build与prepack/prepublishOnly，以便pnpm pack和 npm publish 前把plugin.ts、约定目录和src/编译成可发布 JS。不要把plugin.ts作为发布 manifest 的入口。 已有合法 manifest 会被补齐到相应模式；其它zhin字段形态仍需人工处理。
- 迁移剩余配置：
schema.json（只声明本包字段）、Feature mounts、child plugin mounts。 - 删旧：删掉旧注册代码、旧入口、compat 依赖。
- 验证：构建 + 测试 + 行为验证（命令路由、消息发送、配置默认值、热更新）。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 150 lines · 178 tokens per session scan A 31dc33d8505a
migrate-zhin-plugin-runtime is a skill published in the GitHub repository zhinjs/zhin (135 stars, last pushed today), licensed MIT. It adds 178 tokens to every session and 2,415 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
eliza-cloud
Use when the task involves Eliza Cloud or elizaOS Cloud as a managed backend, app platform, deployment target, billing layer, or monetization surface. The catch-all skill for any user request about THEIR existing apps / containers / earnings / credits / api-keys / analytics / billing / payment requests / payouts …
wegent-knowledge
Knowledge base management and search tools for Wegent. Provides capabilities to list, create, update, and search knowledge bases and documents using RAG retrieval. Use this skill when the user wants to manage knowledge bases, documents, or search for information programmatically.
a0-development
Development guide for extending Agent Zero from current source and DOX. Use for framework architecture, tools, extensions, API/WebUI handlers, agent profiles, prompts, skills, projects, runtime boundaries, and contribution workflow. Load the focused reference files before giving implementation guidance.
webhook-subscriptions
Create and manage webhook subscriptions for event-driven agent activation. Use when the user wants external services to trigger agent runs automatically.
tech-design
A guided process for writing a backend technical design from a product requirements document or feature description. A technical design explains how a feature should work in code and services.
http_request
Make HTTP requests (GET, POST, PUT, DELETE, PATCH) to any API endpoint. Use when: the user asks to call an API, test an endpoint, fetch JSON/data from a URL, or interact with a REST API. NOT for: web scraping (use webscraper), web search (use tavilysearch), or file downloads (use curl/wget).