Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/forthends/clockwork/analyze-projectnpx skills add forthends/clockwork --skill analyze-projectgit clone --depth 1 https://github.com/forthends/clockworkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01249 |
| Opus 5 | $0.00000 | $0.00624 |
| Sonnet 5 | $0.00000 | $0.00250 |
| Haiku 4.5 | $0.00000 | $0.00125 |
Grade A, and why
analyze-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
分析项目代码仓库
技能信息
- 技能名称：分析项目代码仓库
- 技能标识：
analyze-project - 一句话说明：深度扫描
repos/下的代码仓库，提取技术栈、功能说明和模块划分，生成结构化的项目简介 - 适用角色：Analyst
触发条件
当以下条件满足时，应调用本技能：
- 新的代码仓库被挂载到
repos/下，需要生成项目简介 - 项目发生重大变更（如技术栈升级、模块重构），需要更新项目简介
- 其他角色 Agent 需要项目上下文，但对应的项目简介尚不存在
前置条件
调用本技能前，必须确保：
- 目标代码仓库已存在于
repos/<repo-name>/目录 docs/projects/<repo-name>/目录已创建（如不存在则创建）
执行步骤
第一步：扫描依赖管理文件 → 提取技术栈
按语言类型查找并读取依赖管理文件：
| 语言/平台 | 文件 | 提取内容 |
|---|---|---|
| Node.js | package.json |
运行时版本、dependencies、devDependencies、scripts |
| Java | pom.xml / build.gradle |
JDK 版本、Spring Boot 版本、核心依赖 |
| Go | go.mod |
Go 版本、module 名称、依赖列表 |
| Python | pyproject.toml / requirements.txt |
Python 版本、核心依赖 |
| Rust | Cargo.toml |
Rust edition、核心依赖 |
| .NET | *.csproj / *.sln |
.NET 版本、NuGet 依赖 |
对提取到的依赖进行分类：
- 语言与运行时：编程语言、运行时版本
- 核心框架：Web 框架、ORM、状态管理等
- 基础设施：数据库、缓存、消息队列、对象存储等
- 开发工具链：构建工具、测试框架、Lint 工具等
第二步：扫描配置文件 → 提取运行时环境
读取以下文件（如存在）：
docker-compose.yml/Dockerfile→ 容器化方案和中间件依赖.env.example/.env.template→ 需要的环境变量（不读取实际.env）- CI/CD 配置（
.github/workflows/、Jenkinsfile等）→ 构建和部署流程 nginx.conf/ 反向代理配置 → 部署架构
第三步：分析目录结构 → 提取模块划分
- 列出项目顶层目录结构（2-3 层深度）
- 识别核心源码目录（
src/、lib/、app/、cmd/等） - 对每个主要模块/目录：
- 确定模块职责（基于目录名、文件内容）
- 识别模块间依赖关系（基于 import/require 语句）
- 标记核心模块和辅助模块
第四步：分析入口文件 → 提取功能概览
- 找到应用入口（
main.*、app.*、index.*） - 扫描路由定义（API endpoints、页面路由等）
- 读取现有
README.md（如有）补充功能描述 - 汇总为功能清单，按业务领域分组
第五步：生成项目简介
- 读取模板
workflow/_templates/project-overview.md - 按模板结构填写各章节内容
- 保存到
docs/projects/<repo-name>/overview.md
输入
| 输入 | 来源 | 说明 |
|---|---|---|
| 代码仓库 | repos/<repo-name>/ |
待分析的完整代码仓库 |
| 项目简介模板 | workflow/_templates/project-overview.md |
文档结构模板 |
输出
| 输出 | 路径 | 说明 |
|---|---|---|
| 项目简介 | docs/projects/<repo-name>/overview.md |
结构化的项目简介文档 |
质量检查
完成项目简介后，对照以下清单自检：
- tech_stack 章节是否列出了所有主要技术组件及版本
- 技术栈信息是否来源于依赖管理文件（非猜测）
- project_features 章节是否涵盖了项目的核心功能
- 功能描述是否基于代码分析而非仅靠 README
- module_structure 章节是否包含目录结构图
- 每个模块的职责描述是否清晰
- 模块间依赖关系是否有标注
- 是否有敏感信息泄露（密码、API Key 等）
- 不确定的内容是否标注了
[待确认]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 127 lines · 0 tokens per session scan A 752060c3ec99
analyze-project is a skill published in the GitHub repository forthends/clockwork (8 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,249 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
agent-host-chat-contributions
Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.