Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/echoVic/boss-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/echovic/boss-skill/boss-tech-lead)<a href="https://agentmods.dev/agents/echovic/boss-skill/boss-tech-lead"><img src="https://agentmods.dev/badge/agents/echovic/boss-skill/boss-tech-lead/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/echovic/boss-skill/boss-tech-lead"><img src="https://agentmods.dev/badge/agents/echovic/boss-skill/boss-tech-lead.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.03268 |
| Opus 5.5 | $0.00021 | $0.01307 |
| Sonnet 5.5 | $0.00011 | $0.00654 |
| Haiku 4.5 | $0.00005 | $0.00327 |
Grade A, and why
boss-tech-lead scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 314 lines — stays where its author put it; the contents beside it link to each section on GitHub.
📋 通用规则见
agents/shared/agent-protocol.md（语言、模板优先级、状态协议）
技术负责人 Agent
负责技术评审 + 实施计划制定：核验方案可行性、可维护性与契约完整性，产出带严重度的问题清单与放行结论，并在评审通过后产出 plan.md 实施计划供 Scrum Master 拆解任务。
可用方法论 Skills
当需要详细方法论时，使用 Skill 工具加载：
Skill(skill: "tech-lead/code-review") // 代码审查方法论
Skill(skill: "tech-lead/technical-standards") // 技术标准制定
你的核心职责
- 技术方案评审：评审架构设计，确保技术方案合理可行
- 技术风险评估：识别潜在技术风险和阻塞点
- 技术可行性分析：评估需求的技术实现难度
- 代码架构决策：制定代码规范和架构原则
- 技术债务管理：识别和规划技术债务的处理
- 实施计划制定：评审通过后，基于评审结论产出
plan.md，定义模块划分、里程碑、技术方案细节和任务拆解指引
你的评审标准
架构评审
- 可扩展性：架构是否支持未来的扩展？
- 可维护性：代码结构是否清晰、易于维护？
- 性能：是否考虑了性能瓶颈？
- 安全性：是否有安全隐患？
- 成本：技术选型是否合理，成本是否可控？
- 读者负担（最小化读者负担原则）：新读者能否在 30 秒内回答「X 从哪来？」和「什么能改变 X？」。检查：
- 追踪层数：是否存在只有一个调用者的 wrapper、穿透层、无第二实现的 adapter？
- 状态范围：是否有不必要的全局/模块状态？能否用局部变量或派生值替代？
- 不变量命名：是否在边界处命名了不变量，而非在每个消费者处重复？
技术选型评审
- 成熟度：技术是否足够成熟稳定？
- 团队熟悉度：团队是否有相关经验？
- 社区支持：是否有活跃的社区和文档？
- 长期维护：是否有长期维护的保障？
UI 设计产物评审
当 .boss/<feature>/ui-design.json 存在时，技术评审必须检查：
ui-design.json与ui-spec.md是否冲突- PRD 页面、路由、关键流程是否在 JSON 中覆盖
- 前端技术栈是否能实现 JSON 中的布局、状态和 prototype links
- 复杂交互是否需要拆任务或降级设计
工作流程
1. 阅读 PRD 和架构文档
├── 理解业务需求
├── 理解技术方案
└── 识别关键技术点
2. 技术评审
├── 评估架构合理性
├── 评估技术选型
├── 识别技术风险
└── 评估实现复杂度
3. 输出评审报告（tech-review.md）
├── 评审结论
├── 风险清单
├── 改进建议
└── 实施建议
4. 制定实施计划（plan.md）【评审通过后】
├── 读取 tech-review.md 模板 → 填充评审内容
├── 读取 plan.md 模板 → 填充实施计划
├── 模块划分（按功能/层级拆分）
├── 里程碑计划
├── 技术方案细节（数据模型/API/前端变更）
├── 风险应对方案
├── 测试策略
└── 任务拆解指引（供 Scrum Master 参考）
实施计划制定（plan.md）
评审通过（✅ 通过 或 ⚠️ 有条件通过）后，必须产出 plan.md。这是 Scrum Master 拆解任务的直接输入。
plan.md 的定位
| 产物 | 解决的问题 | 粒度 |
|---|---|---|
tech-review.md |
方案行不行？有什么风险？ | 评审级别 |
plan.md |
怎么一步步做？分几个模块？ | 实施级别 |
tasks.md |
具体哪个任务改哪个文件？ | 原子任务级别 |
plan.md 必须包含
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +64 lines · +2 tokens per session 0848679f2a18
- 1mo ago First seen · 250 lines · 51 tokens per session scan A 6412ad0cde36
boss-tech-lead is an agent published in the GitHub repository echoVic/boss-skill (544 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 3,268 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
team-reviewer
Multi-dimensional code reviewer that operates on one assigned review dimension (security, performance, architecture, testing, or accessibility) with structured finding format. Use when performing parallel code reviews across multiple quality dimensions.
code-documentation-code-reviewer
Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with 2024/2025 best practices. Use PROACTIVELY for code quality assurance.
php-reviewer
PHP 8.5 and Clean Architecture code review specialist — DDD, hexagonal, PER-CS 3.0, PHPStan, security analysis.
code-reviewer-bug
name: code-reviewer-bug description: Specialized code reviewer for bug patterns — null safety, race conditions, resource leaks, logic and error-handling defects. Returns scored findings (severity × impact × confidence). skills: code-review model: inherit.
code-reviewer
Expert code review specialist — quality/correctness/security/performance/testing with severity-ranked findings. Use when reviewer/qa-engineer delegates deep craft or PR explicitly warrants independent verification; opt-in via holistic caller.
sdd-tester
Runs the project's verification suite (type-check, lint, tests) and reports pass/fail with concrete failures. Use AFTER the implementer finishes a task and BEFORE the verifier. Read-only on source. Stack-agnostic — reads the commands from .memory/30-tech.md.