Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zhinjs/zhin/plugin-developnpx skills add zhinjs/zhin --skill plugin-developgit clone --depth 1 https://github.com/zhinjs/zhinWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.01240 |
| Opus 5 | $0.00035 | $0.00620 |
| Sonnet 5 | $0.00014 | $0.00248 |
| Haiku 4.5 | $0.00007 | $0.00124 |
Grade A, and why
plugin-develop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Develop（Plugin Runtime）
在已有 Zhin 插件包内实现功能增量。能力按约定目录发现，一个文件一个能力；不要再写 MessageCommand / usePlugin() / addCommand(new …)。
何时使用
- 用户要在插件里「加一个命令 / 工具 / 定时任务 / 控制台页」
- 插件骨架已存在（
plugin-init或zhin new） - 大改目录 → 用仓库内
zhin-plugin-standard-development或迁移 skill
工作流
第 1 步：定位入口与范围
- 找到插件入口：
plugin.ts（或单文件 bot 的bot.ts） - 确认改动类型（只选一种主路径）：
| 能力 | 做法 | 目录 / 位置 |
|---|---|---|
| 聊天命令 | defineCommand() default export |
commands/**/*.ts（路径即路由） |
| AI 工具 | defineAgentTool() |
tools/*.ts 或 agent/tools/*.ts |
| 中间件 | defineMiddleware() |
middlewares/*.ts |
| 组件 | defineComponent() |
components/*.tsx |
| 定时任务 | scheduleHostToken.register(...) + lifecycle |
plugin.ts setup |
| 控制台页 | definePage() |
pages/*.tsx |
| 单文件 demo | setup({ addCommand }) |
仅 examples/single-file-bot 风格 |
- 确认
package.json#zhin.features已挂对应 Feature（如@zhin.js/command） - 输出：要新增/修改的文件清单
第 2 步：实现（禁止旧 API）
- 禁止：
usePlugin、getPlugin、MessageCommand、plugin.addCommand、addCron(new Cron)、useContext('web')旧写法 - 命令：文件路径是路由 SSOT；参数用 Next.js 风格文件名（
[name].ts必需 /[[name]].ts可选 /[...name].ts捕获所有），类型与默认值在defineCommand({ params })中声明；execute读params/args/input - 出站：走统一发送链（
$reply/ Adapter.sendMessage），禁止直调平台 Bot - 本地导入带
.js扩展名
命令示例 commands/greet/[name].ts：
import { defineCommand } from 'zhin.js/command';
export default defineCommand({
description: '问候用户',
params: {
name: { type: 'string', description: '用户名字' },
},
execute({ params }) {
return `你好，${params.name}！`;
},
});
工具示例 tools/get_weather.ts：
import { defineAgentTool } from 'zhin.js/tool';
export default defineAgentTool({
description: '查询天气',
inputSchema: {
type: 'object',
properties: { city: { type: 'string', description: '城市名' } },
required: ['city'],
},
async execute({ city }) {
return `${city}：晴，25°C`;
},
});
定时任务（在 plugin.ts setup；完整骨架见仓库 skill assets/cron-template.ts）：
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 142 lines · 70 tokens per session scan A 83b3010cb0b3
plugin-develop is a skill published in the GitHub repository zhinjs/zhin (135 stars, last pushed 4d ago), licensed MIT. It adds 70 tokens to every session and 1,240 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-development
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development…
tcapi
Skill to call Cloud API for Tencent Cloud (腾讯云). Used for cloud automation or resource management. 当用户需要查询、创建、管理腾讯云资源，或执行云 API 自动化操作时触发。优先使用 Octop 自带 venv 中的 tccli，凭证支持全自动 OAuth 登录。.
test-driven-development
TDD: enforce RED-GREEN-REFACTOR, tests before code.
ckjia-shopping
跨平台比价与购物推荐 / Cross-platform price comparison. 淘宝 / 京东 / 天猫 / 拼多多商品聚合搜索 + 拍图识物。需要先启用 ckjia-shopping MCP server 并配置 CKJIAMCPKEY 才能用。.
xhs_note
小红书图文创作 / 笔记 / 种草文案 (xiaohongshu / red note) — 端到端：成文→配图(≥3 张竖版)→去AI化→在线预览打包交付。以图为主、文字辅助：标题四件套 + 碎句正文 + 话题标签，配 3:4 竖版卡片，最少 3 张图。honors user persona & style memory.
subscription-manager
Create and manage scheduled subscription tasks. Use when the user wants to set up recurring reminders, periodic reports, scheduled checks, or any automated tasks that run on a schedule. Supports cron expressions, fixed intervals, and one-time executions.