Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add attilaszasz/sdd-pilot --skill implementation-standardsgit clone --depth 1 https://github.com/attilaszasz/sdd-pilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/attilaszasz/sdd-pilot/implementation-standards)<a href="https://agentmods.dev/skills/attilaszasz/sdd-pilot/implementation-standards"><img src="https://agentmods.dev/badge/skills/attilaszasz/sdd-pilot/implementation-standards.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00486 |
| Opus 5 | $0.00022 | $0.00243 |
| Sonnet 5 | $0.00009 | $0.00097 |
| Haiku 4.5 | $0.00004 | $0.00049 |
Grade A, and why
implementation-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Implementation Standards
Core Coding Principles
1. Defensive Coding
- Input Validation: Validate at entry point (Controller/API). Never trust user input.
- Fail Fast: Check preconditions immediately. Throw specific errors, not generic 500s.
- Null Safety: Avoid returning
null. UseOptiontypes or explicit "Not Found" errors.
2. Error Handling
- Structured Errors: Standard format (Code, Message, Details).
- Log Context: Log stack trace AND input parameters on catch.
- No Silent Failures: No empty
catchblocks.
3. Testing Mocks
- External Dependencies: Always mock 3rd party APIs in unit tests.
- Determinism: Tests must run without network access.
Common Patterns
Repository Pattern (Data Access)
interface UserRepository {
findById(id: string): Promise<User | null>
save(user: User): Promise<User>
}
Service Layer (Business Logic)
Contains all domain rules. Never access DB directly from Controller.
class UserService {
constructor(repo: UserRepository)
async register(email: string) {
if (await this.repo.findByEmail(email)) {
throw new DuplicateEmailError()
}
// ... logic
}
}
Context-Window Efficiency
When context budget is tight (late in long implementation runs):
- Targeted reads: re-read specific sections, not entire files.
- Defer optional docs: load
data-model.mdandcontracts/only when current task references them. - Summarize: reference earlier findings by key point, don't re-include full content.
Review Checklist for Agents
Before confirming task "Complete":
- Compiles/runs? (No syntax errors)
- Imports clean? (No unused imports)
- Types explicit? (No
anyorvarif avoidable) - Comments helpful? (Explain "Why", not "What")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 62 lines · 44 tokens per session scan A 6dc92307c4eb
implementation-standards is a skill published in the GitHub repository attilaszasz/sdd-pilot (95 stars, last pushed 3d ago), licensed MIT. It adds 44 tokens to every session and 486 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
universal-live-check
Universal live-check framework for coding agents. Executes incremental, deterministic validation across all software domains (CLI, backend, frontend, mobile, embedded, libs). Change-type-aware (feat, fix, hotfix, refactor, migrate, docs). Triggers whenever an agent needs to validate code quality, run linting, perform…
spec-driven-task-decomposer
Use this skill when approved requirements and design need to be decomposed into tasks.md for Phase 3 of a Spec-Driven change. It creates atomic, traceable implementation and testing tasks, validates the plan, and should not be used to design architecture or write implementation code.
archunit-rules
Encode architecture invariants as ArchUnit rules. Use when defining or reviewing layer boundaries, package dependencies, naming conventions, or cross-module access.
jacoco-coverage-policy
JaCoCo configuration and policy enforcement — 90% line+branch floor, 95% target, 95% on new code. Use when wiring JaCoCo into the Maven build or interpreting jacoco.xml.
dependency-injection
Use when writing or reviewing code with object graphs, service dependencies, or testability concerns. Covers constructor injection, DI containers, lifetimes, and anti-patterns (service locator, ambient context, over-injection).
api-runtime-verify
Verify an implemented backend HTTP surface at runtime: per route, record the request actually made, the HTTP status, the response content-type, and the observed body shape, assert each response against the slice's acceptance behavior, classify the findings, and decide a PASS/FAIL/BLOCKED runtime gate. The probe's real…