Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/geekfujiwara/codeappsdevelopmentstandard/update-skillsnpx skills add geekfujiwara/CodeAppsDevelopmentStandard --skill update-skillsgit clone --depth 1 https://github.com/geekfujiwara/CodeAppsDevelopmentStandardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills)<a href="https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills"><img src="https://agentmods.dev/badge/skills/geekfujiwara/codeappsdevelopmentstandard/update-skills.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00202 | $0.04550 |
| Opus 5 | $0.00101 | $0.02275 |
| Sonnet 5 | $0.00040 | $0.00910 |
| Haiku 4.5 | $0.00020 | $0.00455 |
Grade A, and why
update-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
スキル作成・更新 & PR 作成スキル
スキル（SKILL.md + references/ + scripts/）を新規作成または更新し、
リモートリポジトリへ PR を作成・更新するまでを一貫して行う。
サンプル（code-apps/samples/）の追加・更新時は sample-packaging.md のチェックも実施する。
このスキル自身が「良いスキルの形」のテンプレートになっている。守るべき原則は以下の 6 つ。
| 原則 | 内容 |
|---|---|
| 役割分離 | SKILL.md = 正常系のみ。参考情報・異常系は references/、利用スクリプトは scripts/ |
| 汎用化 | テナント・組織・テーマに依存しない。パラメータは references/.env.example に定義し、実値は .env から読む |
| 秘匿化 | 会社名・個別プロジェクト名・実 GUID・URL・メール・シークレットを排除（→ Step 3 のスキャン） |
| シンプル | 本文は短く。冗長な説明は references/ に逃がす。手順の番号は整数の Step で統一 |
| 自動化優先 | 公式仕様は Microsoft Learn MCP で検証、ブラウザ操作は VS Code 統合ブラウザで自動化（→ Step 4） |
| 再発防止 | 作業中にバグ・落とし穴を見つけて直したら references/troubleshooting.md への記録だけで終わらせず、同じ入力パターンで二度と起きないよう scripts/ 本体に恒久的な事前チェック（アサーション/事前検証）を追加し、正常系（成功する実行）でも毎回そのチェックが動く状態にする（→ Step 1 の 6） |
前提ツール: Git、GitHub CLI（
gh、認証済み）、Python 3。 異常系・詰まりどころは references/troubleshooting.md、 PR の更新/新規判断とマージ順は references/pr-strategy.md を参照。
スキル同梱スクリプト（再利用）
scripts/ は汎用化済み。値は引数または .env（references/.env.example 参照）から取得する。
| スクリプト | 用途 |
|---|---|
| scripts/validate_skill.py | 構成検証: フォルダ名＝name 一致 / Step 番号が整数連番 / references・scripts の有無 / 秘匿情報スキャン（Step 3・7） |
| scripts/manage_skill_pr.py | リモートのオープン PR を走査し、対象スキルに触れる PR を検出して「更新 or 新規」とマージ順を提示（Step 5） |
| scripts/publish_skill.py | 公開を一括自動化: PR 先リポジトリを一時 clone → ブランチ → スキル＋集約ファイルをコピー → 検証 → commit → push → PR 作成/更新（Step 6）。--dry-run 対応 |
標準フォルダ構成
<skill-name>/ # kebab-case。frontmatter name と完全一致
├── SKILL.md # 正常系のワークフロー（本文 ~1,500–2,000 語以内）
├── references/ # 参考情報・異常系（オンデマンド読込）
│ ├── troubleshooting.md # 異常系・既知の不具合
│ ├── .env.example # スクリプトが使うパラメータの定義（実値は書かない）
│ └── <topic>.md # その他の参考資料（任意）
└── scripts/ # 利用したスクリプト（すべて汎用化）
└── <verb>_<noun>.py
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 214 lines · 202 tokens per session scan A c530fff16173
update-skills is a skill published in the GitHub repository geekfujiwara/CodeAppsDevelopmentStandard (60 stars, last pushed yesterday), licensed MIT. It adds 202 tokens to every session and 4,550 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
code-to-diagram
Analyze codebases and automatically generate architecture diagrams, flowcharts, and org charts. Uses AST parsing to map import dependencies for Python, JS/TS, Go, and Java, outputting Mermaid or SVG files. Triggered when users ask to visualize code architecture, understand dependencies, draw a flowchart, or create a…
architecture-diagram
Dark-themed SVG architecture/cloud/infra diagrams as HTML.
studio
Architecture Studio control plane — initialize or inspect a studio workspace, create and register projects, or route an architecture/AEC task to the right agent or skill. Use when the user runs /as:studio, asks to set up or open their studio, manage its projects, or describes a task without naming a skill.
csv-to-sif
Export a project's FF&E product-library CSV as dealer-system SIF. Use to produce a .sif schedule; use sif-to-csv for the reverse direction.
modular-skills
Build composable skill modules with hub-and-spoke loading. Use when token budget is tight.