Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zuoyebang/aiweave/new-controllernpx skills add zuoyebang/aiweave --skill new-controllergit clone --depth 1 https://github.com/zuoyebang/aiweaveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zuoyebang/aiweave/new-controller)<a href="https://agentmods.dev/skills/zuoyebang/aiweave/new-controller"><img src="https://agentmods.dev/badge/skills/zuoyebang/aiweave/new-controller.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.01061 |
| Opus 5 | $0.00014 | $0.00531 |
| Sonnet 5 | $0.00006 | $0.00212 |
| Haiku 4.5 | $0.00003 | $0.00106 |
Grade A, and why
new-controller scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
根据 $ARGUMENTS 生成 Controller handler 文件。
公共步骤模板见 skills-spec/01_skill_authoring_guide.md §A-§E。本 Skill 特定内容如下。
第 0 步:拒绝规则与依赖前置
- ⛔ 拒绝(§A.1):路径命中
BUILD_STATUS.md§0 中 🚫 模块路径(如admin/{disabled-module}/*)时立即拒绝 - 状态检查(§A.2):读
BUILD_STATUS.md§5 路由组状态 - 依赖(§A.3):
- 对应 service 未实现 → 先调
/new-service生成 - Internal 路由组首次生成时,先检查共享文件:
controllers/http/internal/render.go(renderInternalResponse)+validator.go,缺失则按docs/architecture/render_functions.md生成
- 对应 service 未实现 → 先调
第 1 步:读取设计文档(公共必读见 §B)
- 主文档:
docs/api/{audience}_interfaces.md - 额外必读:
docs/architecture/routing.md§4、docs/service/service_design.md(确认 service 方法签名)
第 2 步:选择响应模板
Internal 控制器模板(与外部协议对齐的响应格式)
package {module}
import (
"{project}/components"
"{project}/pkg/gin"
"{project}/service/{service_module}"
)
type {Action}Req struct {
Field1 string `json:"field1" binding:"required,max=64"`
}
var {svcVar} = &{service_module}.{Service}Service{}
func {Action}(ctx *gin.Context) {
var req {Action}Req
if err := ctx.ShouldBindJSON(&req); err != nil {
renderInternalResponse(ctx, components.NewServiceError({N}, "请求参数错误"), nil)
return
}
resp, err := {svcVar}.{Method}(ctx, &req)
renderInternalResponse(ctx, err, resp)
}
UserSelf / Admin 控制器模板(标准 errNo/errStr 响应格式)
package {module}
import (
"{project}/components"
"{project}/pkg/gin"
"{project}/pkg/golib/v2/base"
"{project}/service/{service_module}"
)
type {Action}Req struct {
Field1 string `json:"field1" binding:"required,max=64"`
}
var {svcVar} = &{service_module}.{Service}Service{}
func {Action}(ctx *gin.Context) {
var req {Action}Req
if err := ctx.ShouldBindJSON(&req); err != nil { // GET 用 ShouldBindQuery
base.RenderJsonFail(ctx, components.ErrorParamInvalid)
return
}
resp, err := {svcVar}.{Method}(ctx, &req)
if err != nil {
base.RenderJsonFail(ctx, err)
return
}
base.RenderJsonSucc(ctx, resp)
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 119 lines · 28 tokens per session scan A a23bbdeb40e4
new-controller is a skill published in the GitHub repository zuoyebang/aiweave (20 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 28 tokens to every session and 1,061 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
build-teaql-app
Build or change a TeaQL application in Java, Rust, Go, Swift, Python, C#/.NET, or TypeScript, including Kotlin/JVM applications that consume Java-generated libraries. Mandatory order: first draft and save a complete KSML model, then verify the client and evaluate that saved model, repair it through repeated evaluation…
build-executor
Govern implementation from an approved execution contract. Invoke when execution-contract.md is approved and the user wants disciplined build work, TDD execution, or guarded batch-by-batch implementation.
workflow-start
Primary entry point for the spec-superflow state-machine workflow. Invoke when the user is inside an active spec-superflow change directory (look for .spec-superflow.yaml, changes/ /, proposal.md, specs/, design.md, tasks.md, or execution-contract.md) and asks to start, continue, resume, implement, plan, or figure out…
release-archivist
Close out a spec-superflow change with verification, summary, and archive readiness. Invoke when implementation is complete, verification is underway, or the user asks for a final wrap-up.
bug-investigator
Use when encountering any bug, test failure, or unexpected behavior during spec-superflow execution, before proposing fixes. Invoked automatically when build-executor hits a blockage.
contract-builder
Convert approved planning artifacts into an execution contract. Invoke when the user wants to start building, asks to move from planning to implementation, or when execution-contract.md is missing or stale.