Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dhslegen/digital-delivery-team --skill delivery-packagegit clone --depth 1 https://github.com/dhslegen/digital-delivery-teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dhslegen/digital-delivery-team/delivery-package)<a href="https://agentmods.dev/skills/dhslegen/digital-delivery-team/delivery-package"><img src="https://agentmods.dev/badge/skills/dhslegen/digital-delivery-team/delivery-package/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dhslegen/digital-delivery-team/delivery-package"><img src="https://agentmods.dev/badge/skills/dhslegen/digital-delivery-team/delivery-package.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01271 |
| Opus 5 | $0.00013 | $0.00635 |
| Sonnet 5 | $0.00005 | $0.00254 |
| Haiku 4.5 | $0.00003 | $0.00127 |
Grade A, and why
delivery-package scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **禁止**在 actuator 不可用时写 `curl /api/actuator/health`（会 404 `No static resource`） How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Delivery Package
Triggers
- docs-agent 启动 / /package 命令
Package Must Contain
README.md（5 分钟上手）docs/deploy.md（幂等部署）docs/demo-script.md（3–5 分钟演示）- 质量守门产物（
tests/test-report.md+docs/review-report.md）
README 8 要素（缺一不可）
- 一句话定位（What）：让读者 5 秒内判断是否值得继续读
- 受众与场景（Who / When）：明确谁在什么场景下使用
- 5 分钟上手（copy-paste 命令序列）：必须实际可跑通，含
make bootstrap或等价一键命令 - 目录结构导览：列出关键目录及其用途
- 常见问题（Top 5 FAQ）：覆盖最高频的上手障碍
- 相关文档索引：链接到 arch.md / api-contract.yaml / deploy.md
- 维护者与反馈渠道：姓名 + 联系方式（用
<YOUR_EMAIL>占位） - 许可证：明确声明
Deploy 原则
-
幂等：重复跑 5 次，结果与第 1 次完全一致
-
环境变量注入：不硬编码任何密钥、内网地址、账号信息（一律
<YOUR_XXX>） -
回滚脚本：必须有对应的 rollback 命令或说明
-
环境校验：跑前自检（Node 版本、必要工具、磁盘空间）
-
脚本头部：
set -euo pipefail -
事实驱动（D36 / v0.9.20）：必读
.ddt/deployment-facts.json（由bin/audit-deployment-config.mjs生成），禁止凭常识填以下 5 个值：- MySQL root 密码：用
facts.derived.mysql_root_password（不得写root、123456、password等"常见值"——除非 facts 实际是这个值） - MySQL 端口 / 数据库名：用
facts.derived.mysql_database+facts.server.datasource.port - 后端端口 / context-path：用
facts.server.server.port+facts.server.server.context_path - 前端 dev 端口：用
facts.web.dev_port（vite 默认 5173 / next 默认 3000 / cra 默认 3000） - smoke 测试 health endpoint：用
facts.smoke_endpoint——- actuator 装好且暴露 →
GET /actuator/health - actuator 缺失 → 用 facts 推断的 fallback（contract 第一个 GET 或
/auth/login） - 禁止在 actuator 不可用时写
curl /api/actuator/health（会 404No static resource）
- actuator 装好且暴露 →
facts.json 缺失（audit 失败）→ deploy.md 顶部必须加显式 ⚠️ 警告 + 用
<YOUR_XXX>占位 + 提示用户跑node $DDT_PLUGIN_ROOT/bin/audit-deployment-config.mjs补全。 - MySQL root 密码：用
Demo Script 原则
- 时间轴精确到 10 秒（示例：
00:00–00:30 展示登录流程） - 每步标注三项：动作 / 期望屏幕状态 / 口播稿
- 总时长 3–5 分钟，聚焦 1–2 个核心特性，不要塞进 10 个特性
- 有意外演示备选分支（网络挂了 / 接口超时时的应对预案）
Do
- 用
<YOUR_XXX>占位所有真实密钥、邮件、内网地址 - 部署脚本加
set -euo pipefail - README 第一段必须让人知道"值不值得继续读"
- 所有示例命令在 clean 环境下实际验证可跑通
Don't
- README 不是 changelog，不要罗列每次更新历史
- 部署不要依赖"先手工改一下 XXX 再运行"
- Demo 不要总时长超过 5 分钟或覆盖超过 3 个特性
- 不在 README 里放真实用户数据或截图中含敏感信息
- D36 反模式：不要凭常识写
MYSQL_ROOT_PASSWORD=root/curl /api/actuator/health/ 其它"假定默认"——这些导致演示翻车的硬编码假设必须从.ddt/deployment-facts.json派生
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 76 lines · 26 tokens per session scan A cd42f666b10e
delivery-package is a skill published in the GitHub repository dhslegen/digital-delivery-team (1 stars, last pushed 3mo ago), licensed MIT. It adds 26 tokens to every session and 1,271 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
design-system-reference
Style guides and implementation rules for frontend design. Works with design-discovery agent which handles context gathering and VS-based style recommendations. Contains detailed style guides, anti-patterns, and implementation checklists.
team-memory-protocol
A shared-memory process for teams of coding agents working on the same build. It stores project knowledge, shared context, and task progress in separate files or repositories.
knowledge-wiki
A tool that turns useful lessons from coding sessions into general articles for a team wiki. A wiki is a collection of linked reference pages, and this one can be kept locally or shared through a Git repository.
handdrawn-diagram
Generate a hand-drawn (sketch-style) architecture or flow diagram as a committable image (SVG + PNG). Use when the user wants a sketch-aesthetic diagram for a README, docs, or hackathon/Devpost submission that still has correct, legible text and per-group color. Authors a Mermaid look:handDrawn source and renders it…
code-review-levels
Reference documents for deep code review (Level 3) and architecture review (Level 4). Used by code-reviewer agent for advanced review levels.
version-sentinel
Use when adding, bumping, or changing a dependency in package.json, requirements.txt, constraints.txt, pyproject.toml, Cargo.toml, .csproj, .fsproj, or .vbproj. Triggered automatically by version-sentinel's PreToolUse hook (where the host supports hooks) — this skill explains how to satisfy the block and record a…