Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/davidyichengwei/agentic-engineering-framework/workflow-code-generationnpx skills add davidYichengWei/agentic-engineering-framework --skill workflow-code-generationgit clone --depth 1 https://github.com/davidYichengWei/agentic-engineering-frameworkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00089 | $0.01420 |
| Opus 5 | $0.00044 | $0.00710 |
| Sonnet 5 | $0.00018 | $0.00284 |
| Haiku 4.5 | $0.00009 | $0.00142 |
Grade A, and why
workflow-code-generation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
代码生成
所有代码修改的统一入口。先加载规范，再写代码。
工作流程
步骤 1：评估复杂度与路径路由
⚠️ 防御性检查：如果 AI 无法明确回答"要改什么模块/文件"、"要实现什么行为"、"怎样算完成"这三个问题中的任何一个，则立即停止，调用
workflow-requirements-clarification。本 skill 不负责需求澄清。
默认走标准流程（步骤 2 → 3 → 4 → 5）。Fast-Path 仅当改动为单文件、局部改动（能在路由阶段确定完整文件列表，且只涉及 1 个文件的局部修改）时才可进入。
无法确定 → 标准流程。
Fast-Path 执行
- 加载编码规范（同步骤 4）
- 实现改动
- 执行过程中发现实际需要改多个文件 → 立即退出，回到步骤 2 进入标准流程
- 询问用户是否需要 code review
- 需要 → 加载
workflow-code-reviewskill（指定skip_reviewers: [magical-prompt-reviewer]）→ 修复循环 - 不需要 → 输出改动说明
- 需要 → 加载
- 结束，不进入后续步骤
标准流程入口
查找 docs/design-docs/<module>/<feature>/spec.md：
- 存在且完整 → 仔细通读全文（不要只读关注的章节），确认理解
- 不存在/不完整 → 调用
workflow-requirements-clarification（禁止自行澄清）
强制：spec.md 与 tasks.md 同时存在时，编码前必须完整读取两者。
步骤 2：选定当前任务
从 tasks.md 中找第一个未完成任务，记录其编号和上下文。
步骤 3：检查/创建 tasks.md
- 已存在 → 找第一个未完成任务，进入步骤 4
- 不存在 → 先读取 reference/task_planning_guide.md，然后严格按其流程创建
tasks.md
🚨 创建 tasks.md 后必须停下来等用户确认。 展示任务列表，然后停止并等待用户回复。禁止自动进入步骤 4。
步骤 4：加载编码规范（🚨 强制前置）
未加载规范就写代码 → 立即停止，先加载。
必须加载
| 规范 | 说明 |
|---|---|
bp-coding-best-practices |
通用编码最佳实践 |
bp-performance-optimization |
性能优化（所有代码都是性能敏感的） |
按需加载
| 规范 | 何时加载 |
|---|---|
std-cpp |
.cc/.cpp/.h 文件 |
std-go |
.go 文件 |
bp-distributed-systems |
涉及网络通信、多节点协调、一致性、故障恢复 |
步骤 5：逐个任务实现
核心规则：一个 Task → review 通过 → 报告 → 等用户批准 → 下一个 Task
Phase 1: 实现
修改代码，更新 tasks.md 标记 In Progress。
Phase 2: Code Review 与修复循环（🚨 强制）
4a. 执行 Code Review
加载 workflow-code-review skill，按其工作流执行（指定 skip_reviewers: [magical-prompt-reviewer]）。该 skill 会并行调用 reviewer subagent 执行审查——禁止主 agent 自己做 review 代替 subagent。
4b. 逐条反思犯错原因
对报告中每条 keep 的 finding，反思犯错原因：
| 原因分类 | 含义 |
|---|---|
| Spec 理解偏差 | spec 写清楚了但理解错误 |
| 规范未遵守 | 编码规范有要求但未执行 |
| 执行遗漏 | 漏掉边界/细节 |
| 设计考虑不足 | 需更深层设计思考 |
4c. 自动修复 → Re-review 循环
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 144 lines · 89 tokens per session scan A 8d0cc2079bfc
workflow-code-generation is a skill published in the GitHub repository davidYichengWei/agentic-engineering-framework (159 stars, last pushed 5mo ago), licensed MIT. It adds 89 tokens to every session and 1,420 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…