基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/pymc-labs/daimon --skill cli-auth命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | cli-auth |
| description | Mint short-lived CLI access tokens via the daimon MCP server's get_cli_token tool. |
Use the daimon MCP server's get_cli_token(service) tool to mint short-lived
access tokens for external CLIs. Export the result as the appropriate env var
before running CLI commands.
| Service | Tool call | Env var to export |
|---|---|---|
| GitHub | get_cli_token("github") | GH_TOKEN (or GITHUB_TOKEN) |
| Google Cloud / Workspace | get_cli_token("gcloud") | CLOUDSDK_AUTH_ACCESS_TOKEN |
Example shell flow:
export GH_TOKEN=$(get_cli_token github)
gh repo list
The tool requires:
github: an operator (or a Discord user via /agent-setup) must have
bound a GitHub PAT. Tokens are minted from the persisted PAT.gcloud: The agent must be bound to a Google identity
(agent_google_binding) with appropriate scopes, configured by an operator.
Tokens are short-lived (≈1 hour) impersonated access tokens.Tokens are minted fresh per call and never cached.
Mutate data without destroying the evidence — dedup, dtype coercion, missing-value decisions, outlier flagging, category and unit normalisation, joins, pivots and aggregations to a new grain, and columns the source does not contain — appending a row to run/changelog.jsonl for every operation, whether what you write is one parquet file, one part per table, parquet parts of a log too large to load, a saved warehouse query, or cleaned files plus their index frame. The source is never edited in place, and under pandas 3 copy-on-write a chained assignment like df[mask]["col"] = 0 silently changes nothing. Use when a validation check failed, when the grain has duplicates, wrong dtypes or unparseable dates, when a source is too large or raw to query repeatedly and must be materialised once as typed parquet parts, when a collection needs an index frame derived, when a metric or label no column holds must be defined, or when asked to clean, dedup, impute, join, reshape or fix a dataset.
Load whatever the request points at — one CSV or Excel export, twelve related tables, a folder of 500 emails, a 4 GB log you never load, a warehouse table you query in place — and record every source in run/manifest.json with the grain one row represents, the axis it is ordered by, its row count, columns and dtypes. Read as text and coerce on purpose — pd.read_csv inference turns order_id 00123 into the integer 123, and a paged pull that stops early looks identical to a complete one. Use when a user attaches a file or a folder, points you at a database, warehouse or API, or asks for analysis of data you have not loaded yet.
Decide whether data is fit to analyze before anyone analyzes it. A phase-1 pass runs in seconds — dtypes, the grain one row claims to represent, referential gaps between tables, plausibility ranges, coverage — and emits run/validation.json with a pass/warn/fail verdict; a fail is a stop, not a to-do item. Works the same on a flat export, twelve related tables, a keyless sensor stream, an index frame over 500 documents, or a warehouse table you check with SQL and never load. Phase 2 hunts the structural break — a definition, unit, currency or timezone that changed partway along whatever the data is ordered by. Use when data arrives from ingestion, before any chart, join or model, or when a number looks wrong and you cannot say why.