Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bifrost-proxy/bifrost/rust-project-validatenpx skills add bifrost-proxy/bifrost --skill rust-project-validategit clone --depth 1 https://github.com/bifrost-proxy/bifrostWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00046 | $0.00848 |
| Opus 5 | $0.00023 | $0.00424 |
| Sonnet 5 | $0.00009 | $0.00170 |
| Haiku 4.5 | $0.00005 | $0.00085 |
Grade A, and why
rust-project-validate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Rust 项目规范校验
必须:该技能在任务结束前执行一键规范校验,确保代码风格、静态检查、构建与测试均通过。 避免:还没进行 api和交互测试的情况下,就开始执行规范校验,因为这时候代码可能还不是最终版本,还不能确保通过所有测试用例。
何时调用
- 每次开发任务结束前必须调用
- 提交代码或发起评审前建议调用
执行内容
- 格式检查:
cargo fmt --all -- --checkcargo fmt --manifest-path desktop/src-tauri/Cargo.toml --all -- --check
- Lint 检查:
cargo clippy --all-targets --all-features -- -D warnings - 执行端到端用例,按本次任务的测试范围执行
- 运行测试:优先按修改范围执行
cargo test,避免无差别跑完整套耗时用例 - 完整构建:
cargo build --all-targets --all-features(避免无差别构建,应该按改动范围构建) - 工作区兜底测试:开发完成后必须至少执行一次
cargo test --workspace --all-features,避免提交后才在 CI 中暴露失败
如果任一步失败,立即停止并返回失败报告。
验证顺序补充
- 对 UI / push / 管理端交互问题,必须先做 E2E 或 API 交叉验证,再进入
fmt/clippy/build - 在跑
clippy/build/test前,先确认没有遗留的cargo、rustc、旧bifrost进程,避免互相抢锁造成假卡死 - 如果前面为了调试开过多轮
cargo test或cargo clippy,进入本技能前先清理残留任务,再顺序执行校验
输出
- 结构化报告,按步骤给出状态(通过/失败)与关键信息
- 当
fmt --check失败时提示可使用以下命令自动修复:cargo fmt --allcargo fmt --manifest-path desktop/src-tauri/Cargo.toml --all
- 当
cargo test --workspace --all-features失败时,必须在报告里明确指出这是 CI 风险,不能默默跳过
前置条件
- 项目为 Rust 工作空间,已正确安装 Rust toolchain 与 cargo
- 在仓库根目录执行
示例
运行本技能将顺序执行:
cargo fmt --all -- --check # 检查工作区 Rust 代码格式
cargo fmt --manifest-path desktop/src-tauri/Cargo.toml --all -- --check # 检查 desktop Tauri Rust 代码格式
cargo clippy --all-targets --all-features -- -D warnings # 检查代码是否符合 Rust 编码规范
cargo test -p bifrost-e2e -- --list # 先确认本次需要覆盖的 E2E 范围
cargo test -p <changed-crate> --all-features # 按修改范围执行测试
cargo build --all-targets --all-features # 最终构建项目
注意
- 与项目规则一致:参考 ../../rules/project_rules.md
- 若改动涉及
desktop/src-tauri,必须确保本地执行过独立fmt检查,不能只依赖工作区根cargo fmt --all -- --check
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 65 lines · 46 tokens per session scan A 248dcf2e6f6a
rust-project-validate is a skill published in the GitHub repository bifrost-proxy/bifrost (124 stars, last pushed 3d ago), licensed MIT. It adds 46 tokens to every session and 848 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codex-e2e-test
Run PR-grade real Codex E2E validation through claude-tap, including resume turns, multiple tool calls, optional image input, viewer verification, and screenshot evidence.
build-brightstaff
Build the brightstaff native binary. Use when brightstaff code changes.
playwright-screen-recording
Record browser test videos with Playwright for PR review and bug fix verification.
translate-i18n
Fill missing i18n translations in the viewer source JSON. Run this after adding or modifying English or Chinese UI strings in claudetap/vieweri18n.json — it auto-translates to ja, ko, fr, ar, de, ru via OpenRouter.
push-release
Push to GitHub and optionally bump version to trigger PyPI release.
omh-image-cards
This is a Hermes-native img-summary workflow skill.