Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agent-tower/core/agent-tower-devnpx skills add agent-tower/core --skill agent-tower-devgit clone --depth 1 https://github.com/agent-tower/coreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00100 | $0.00944 |
| Opus 5 | $0.00050 | $0.00472 |
| Sonnet 5 | $0.00020 | $0.00189 |
| Haiku 4.5 | $0.00010 | $0.00094 |
Grade A, and why
agent-tower-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Tower 开发指南
工作流程
- 读取与任务对应的 reference，再检查同领域最近的实现和测试；以代码为准，历史设计可能过时。
- 标出受影响的共享类型、数据库、Service/Route、Socket/MCP、前端 cache/store、生命周期和测试。
- 沿用邻近模块的错误响应和依赖模式。新旧模式并存时，不借局部改动统一全仓库。
- 将业务不变量放 Service，将进程生命周期放
SessionManager/AgentPipeline，让 HTTP 层只解析和响应。 - 先运行最窄测试，再构建受影响包；跨层契约变化时扩大验证。
按需读取
- Route/Service、Prisma、Socket、workspace、认证、preview、MCP：backend-patterns.md
- React、Query cache、Zustand、实时同步、i18n：frontend-patterns.md
- Session、PTY、Executor、Parser、MsgStore、新增 Agent：pipeline-patterns.md
- TeamRun、成员、消息、WorkRequest、Invocation、成员 workspace：teamrun-patterns.md
- Electron runtime、打包、公开文档站：desktop-docs-patterns.md
必守边界
- 将跨端实体、状态和 Socket payload 放在
@agent-tower/shared；server ESM import 保留.js后缀。 - Prisma 业务状态通常存为
String，由 shared enum/union 约束；JSON string 在 Service 边界转换。 - 实时变更同时检查
EventMap、shared Socket contract、SocketGateway和前端重连/缓存失效。 - 不绕过 tunnel/access/Socket auth、CSRF、internal token、local-only、preview token 或 loopback 限制。
- 同时支持
WORKTREE与MAIN_DIRECTORY；不要假设每个项目都是 Git 仓库或每个任务只有一个 workspace。 - 使用根
package.json固定的 pnpm 版本；新增带安装脚本的依赖时先审核脚本，再在pnpm-workspace.yaml的allowBuilds中明确设为true或false。 - 保留 PTY early-event handoff、parser exactly-once finish、原始 stdout 兜底和日志脱敏。
- 列表热路径使用 preview/truncated DTO；完整 task/message 正文按需加载。
自动维护本 Skill
完成每个开发任务前，检查本次变更是否改变了可复用的项目边界：包或模块职责、跨包类型/API/Socket/MCP 契约、生命周期或状态机、认证与信任边界、workspace/session/TeamRun/desktop runtime 语义、标准目录或开发命令。
若改变任一边界，必须在同一变更中更新本 SKILL.md 或对应 reference，删除已失效说明，并运行 skill validator。局部算法、一次性 bug 修复或容易继续变化的实现细节不写入 skill；只记录会影响后续 Agent 决策的稳定且非显然规则。
验证
pnpm exec vitest run <test-file>
pnpm --filter @agent-tower/shared build
pnpm --filter @agent-tower/server build
pnpm --filter web build
pnpm build
pnpm build:publish
pnpm publish:smoke
公开行为变化同步 packages/docs-site/docs/；内部计划和专项排障才写顶层 docs/。跨包构建遵循 shared -> server -> web/desktop。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 57 lines · 100 tokens per session scan A 234158cd857b
agent-tower-dev is a skill published in the GitHub repository agent-tower/core (338 stars, last pushed 22d ago), licensed Apache-2.0. It adds 100 tokens to every session and 944 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…