Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evolplus/talos/sdlc-loopnpx skills add evolplus/talos --skill sdlc-loopgit clone --depth 1 https://github.com/evolplus/talosWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.01012 |
| Opus 5 | $0.00036 | $0.00506 |
| Sonnet 5 | $0.00015 | $0.00202 |
| Haiku 4.5 | $0.00007 | $0.00101 |
Grade C, and why
sdlc-loop scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
directories with `rm -rf -- .worktrees/<role>-<task-id>/`. Then remove the How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SDLC Loop
Purpose
Codex plugins do not expose Claude-style slash commands from commands/.
This skill is the Codex command shim for /sdlc-loop.
Use it when the operator wants the kit to start or continue the governed SDLC workflow.
Before Running
- Read the project
AGENTS.mdif it exists. - Read the plugin contract skill
evo-devkit-contract. - Resolve any
.claude/rules/...references in injected guidance to the plugin-localrules/...files when running in Codex, because the default Codex target does not copy.claude/into the project. - Read only the rule files needed for the current route. For a normal loop
invocation, these are usually:
rules/orchestrator-operating-rules.mdrules/autonomous-loop.mdrules/task-type-routing.mdrules/srs-signoff-protocol.mdrules/master-plan-discipline.mdrules/parallel-execution.mdrules/worktree-isolation.mdrules/hard-rules.md
Arguments
Treat text after sdlc-loop or /sdlc-loop as arguments.
--tier aggressive|standard|conservative- override workload tier for this run.--max-iterations N- soft cap for loop iterations. Default: 50.--schedule [cadence]- if Codex automation tools are available, register a recurring run of the same prompt without--schedule; otherwise report that scheduling is unavailable in this environment.
Loop Procedure
Run as the Orchestrator:
- Perform pre-flight once:
- verify repository and git identity when a git repo exists;
- reconcile root-level
plan-update*.jsonstragglers; - run crash-recovery reconciliation if dispatch journals exist;
- record the active workload tier.
- At the top of every iteration, read state from disk:
docs/SRS.mdstatus;docs/open-issues.md;docs/plan/;docs/iteration-plan/;docs/architecture.mdvalidation status;- deploy and QA reports when relevant.
- Check halt conditions before dispatching:
- unresolved human decision;
- open issue that is not resolved, deferred, or promoted;
- unsigned SRS or unvalidated architecture;
- missing design confirmation for UI work;
- dependency approval, external-integration adequacy, or QA failure that needs human or role-specific action;
- circuit breaker or iteration cap.
- If not halted, identify the eligible batch and dispatch the matching role.
- On each role return, validate exit criteria, promote validated role-owned
artifacts by path-scoped ingestion, apply
plan-update.json, and commit artifacts + task-state updates together according to the rules. Record the resulting full commit SHA asfinalization.state: finalizedin the dispatch journal before cleanup. Remove registered Git worktrees with thegit worktree remove --forcecommand. Remove logical-role handoff-only directories withrm -rf -- .worktrees/<role>-<task-id>/. Then remove the journal last withrm -- .claude/dispatch-journal/<role>-<task-id>.json. The Bash guard permits only these path-bounded cleanup targets. The marker lets SessionStart safely collect residue when final cleanup is interrupted. - Auto-route non-human failures to the owning role:
- SRS validator failure -> BA Mode D;
- architecture validator failure -> SA revision;
- design completeness failure -> UI/UX Designer revise or incorporate;
- QA failure -> responsible Dev, QA-Author, DevOps, SA, UI/UX, or BA based on the failed artifact.
- Stop at the first halt condition and summarize the exact unblock action.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 99 lines · 73 tokens per session scan C 50b771d41c08
sdlc-loop is a skill published in the GitHub repository evolplus/talos (8 stars, last pushed 28d ago), licensed Apache-2.0. It adds 73 tokens to every session and 1,012 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…