Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add znlgis/opengis-skills --skill acme.shgit clone --depth 1 https://github.com/znlgis/opengis-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/znlgis/opengis-skills/acme.sh)<a href="https://agentmods.dev/skills/znlgis/opengis-skills/acme.sh"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/acme.sh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/znlgis/opengis-skills/acme.sh"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/acme.sh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.02942 |
| Opus 5 | $0.00035 | $0.01471 |
| Sonnet 5 | $0.00014 | $0.00588 |
| Haiku 4.5 | $0.00007 | $0.00294 |
Grade C, and why
acme.sh scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl https://get.acme.sh | sh -s [email protected] Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **零依赖**：纯 POSIX Shell 实现，无需 Python/Node/Java，只要有 `curl`/`wget` 与 `cron`/`crontab` 即可。 How it starts
The opening of the file, as written. The whole thing — 240 lines — stays where its author put it; the contents beside it link to each section on GitHub.
项目地址： https://github.com/acmesh-official/acme.sh
官方文档（Wiki）： https://github.com/acmesh-official/acme.sh/wiki
官网： https://acme.sh
许可证： GPL-3.0 ｜ 最新版本： 3.1.3（2026-04）｜ 默认分支：
master
概述
acme.sh 是全球使用最广泛的 ACME 客户端之一（GitHub 47k+ Star），由 neilpang 发起维护，核心特点：
- 零依赖：纯 POSIX Shell 实现，无需 Python/Node/Java，只要有
curl/wget与cron/crontab即可。 - 跨平台：Linux 全发行版、macOS、*BSD、Solaris、Windows（WSL/Cygwin/Git Bash）。
- 多 CA：默认 ZeroSSL，可切换 Let's Encrypt、BuyPass、Google Trust Services（GTS）、SSL.com 等。
- 多验证方式：HTTP-01（webroot / standalone / nginx / apache）、DNS-01（150+ 服务商 API，支持通配符）、TLS-ALPN-01。
- 自动续期：安装时自动写入 cron，默认约 30 天（ARI 自动调度）触发续期，无 ARI 时回退为 60 天。
- 证书部署：内置 100+ deploy hook（nginx、ssh、docker、panel、CDN、路由器等）。
- 证书类型：单域名、多域名 SAN、通配符
*.example.com、ECC（ec-256/384）与 RSA 双证书。
⚠️ 不要用 root 直接运行
git仓库里的./acme.sh：请先--install到~/.acme.sh，由安装后的副本管理证书与 cron。
安装
# 方法一：在线安装（推荐，-m 注册账户邮箱用于到期通知）
curl https://get.acme.sh | sh -s [email protected]
# 或 wget
wget -O - https://get.acme.sh | sh -s [email protected]
# 方法二：从 git 仓库安装
git clone --depth 1 https://github.com/acmesh-official/acme.sh.git
cd acme.sh
./acme.sh --install -m [email protected]
# 高级自定义安装目录
./acme.sh --install \
--home /opt/acme.sh \
--config-home /opt/acme.sh/data \
--cert-home /etc/ssl/acme
安装会做三件事：复制脚本到 ~/.acme.sh/、创建 acme.sh 别名、写入每日 cron。安装后重载 shell 或：
source ~/.bashrc
acme.sh --version # 验证
升级：
acme.sh --upgrade # 手动升级
acme.sh --upgrade --auto-upgrade # 开启自动升级
acme.sh --upgrade --auto-upgrade 0 # 关闭自动升级
核心命令
选择 CA（默认 ZeroSSL，常切到 Let's Encrypt）
acme.sh --set-default-ca --server letsencrypt
# 可选：zerossl / buypass / google / sslcom
# ZeroSSL / Google 需先注册账户（EAB）
acme.sh --register-account -m [email protected] # ZeroSSL
acme.sh --register-account -m [email protected] --server google \
--eab-kid <KID> --eab-hmac-key <HMAC> # Google GTS
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 240 lines · 70 tokens per session scan C 6e97f4203cd6
acme.sh is a skill published in the GitHub repository znlgis/opengis-skills (61 stars, last pushed today), licensed MIT. It adds 70 tokens to every session and 2,942 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
acme
ACME protocol and SSL/TLS certificate automation reference. Covers challenge types (HTTP-01, DNS-01, TLS-ALPN-01), major clients (certbot, acme.sh, lego, Caddy), certificate lifecycle management, Kubernetes cert-manager, Docker/Traefik integration, and security best practices.
performing-ssl-certificate-lifecycle-management
SSL/TLS certificate lifecycle management encompasses the full process of requesting, issuing, deploying, monitoring, renewing, and revoking X.509 certificates. Poor certificate management is a leading.
ssl-tls
TLS certificate lifecycle — Let's Encrypt HTTP-01 and DNS-01 issuance, renewal automation, mTLS, HSTS, OCSP stapling, certificate inspection, and Nginx TLS hardening.
salvo-tls-acme
Configure TLS/HTTPS with automatic certificate management via ACME (Let's Encrypt). Use for production deployments with secure connections.
performing-kubernetes-etcd-security-assessment
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.
configuring-tls-1-3-for-secure-communications
TLS 1.3 (RFC 8446) is the latest version of the Transport Layer Security protocol, providing significant improvements over TLS 1.2 in both security and performance. It reduces handshake latency to 1-R.