Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zilliztech/zilliz-plugin --skill aclgit clone --depth 1 https://github.com/zilliztech/zilliz-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zilliztech/zilliz-plugin/acl)<a href="https://agentmods.dev/skills/zilliztech/zilliz-plugin/acl"><img src="https://agentmods.dev/badge/skills/zilliztech/zilliz-plugin/acl/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zilliztech/zilliz-plugin/acl"><img src="https://agentmods.dev/badge/skills/zilliztech/zilliz-plugin/acl.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.02763 |
| Opus 5 | $0.00037 | $0.01381 |
| Sonnet 5 | $0.00015 | $0.00553 |
| Haiku 4.5 | $0.00007 | $0.00276 |
Grade A, and why
acl scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prerequisites
- CLI installed and logged in (see setup skill).
- No cluster context required -- these are control-plane operations.
- The
/v2/roles,/v2/members, and/v2/groupsroutes must be enabled for the caller's endpoint. They are still rolling out: a 404 from anyzilliz aclcommand means the API is not live there yet.
Commands Reference
zilliz acl is a three-level tree -- acl role, acl member, and acl group. It is deliberately absent from zilliz --help and shell completion while the routes roll out, but every command below runs today and every --help under it works.
Roles
# One project's roles: the pre-defined project roles plus that project's
# custom roles. --project-id is required; it is prompted for when omitted.
zilliz acl role list --project-id <project-id>
# Optional: --page <n>, --page-size <n>, --all
# Org roles (--project-id is rejected here: org roles have no project boundary)
zilliz acl role list --type org
zilliz acl role describe <role-id>
# Optional: --project-id <project-id>
zilliz acl role principals <role-id> --all
# Optional: --project-id <project-id>, --page <n>, --page-size <n>
# Lists the members, groups, and API keys the role is bound to.
zilliz acl role delete <role-id>
# Optional: --project-id <project-id>
# Confirms first; pass -y to skip.
--project-id on describe, principals, and delete is the project boundary
of a pre-defined project role, which carries none of its own. A custom role is
addressed by ID alone.
Create and update a role
zilliz acl role create --name <role-name> --project-id <project-id> \
--policy project_member:view \
--policy 'serving_cluster:view,modify=in01-a,in01-b'
# Optional: --description <text>, --policies-file <path>
zilliz acl role update <role-id> --description <text>
# Optional:
# --name <role-name>
# --project-id <project-id>
# --policy <shorthand>
# --policies-file <path>
# -y
Only project roles can be created; the API has no org-role create path.
update replaces the policy wholesale -- it never merges -- and prompts before
shrinking the statement count unless -y is passed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 225 lines · 74 tokens per session scan A e706d994e7b4
acl is a skill published in the GitHub repository zilliztech/zilliz-plugin (3 stars, last pushed yesterday), licensed Apache-2.0. It adds 74 tokens to every session and 2,763 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
clawhub-convex
Apply ClawHub-specific Convex conventions and route to the right managed Convex skill. Use for any change under convex/, Convex commands or deployment targeting, query performance, migrations, retention, runtime validation, or skill stat reads and writes in the ClawHub repository.
convex-migration-helper
Plans Convex schema and data migrations with widen-migrate-narrow and @convex-dev/migrations. Use for breaking schema changes, backfills, table reshaping, or zero-downtime rollouts.
convex
Convex is the backend agents get right on the first try: an all-TypeScript reactive platform where the database, server functions, scheduling, file storage, auth, and realtime sync are one type-safe system, every function is a transaction, and tsc catches most mistakes before deploy. Ideal BOTH for a quick prototype…
create-and-cleanup-migration
Use for end-to-end ClawHub Convex production migrations, backfills, destructive cleanups, and one-off maintenance functions that must be created, validated, shipped, run, verified, then removed after completion.
convex-expert
Convex backend specialist. Use this agent for any code inside a convex/ directory — function definitions, schemas, indexes, queries, mutations, actions, HTTP endpoints, cron jobs, file storage, auth wiring, and component installation. Knows the object-form function syntax, validator patterns, resource limits, and…
convex-design
Design and build reactive, type-safe, production-grade backends on Convex. Covers schema, queries/mutations/actions, indexes, auth, file storage, scheduling, real-time multiplayer, mobile backends, and LLM/agent workflows on Convex's one-platform stack.