Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/harness-base/harness-control/hc-devnpx skills add harness-base/harness-control --skill hc-devgit clone --depth 1 https://github.com/harness-base/harness-controlWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00251 | $0.03475 |
| Opus 5 | $0.00125 | $0.01737 |
| Sonnet 5 | $0.00050 | $0.00695 |
| Haiku 4.5 | $0.00025 | $0.00347 |
Grade A, and why
hc-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
开发总监编排（hc-dev）
本 skill = 开发总监总谱：主 agent 当总监——吃上游 → 按改动面定编制 → 派 worker 写码（契约为接缝）→ 对抗 review → 收尾交棒。形态 ≈ hc-test（总监编排）；纪律全程常开、编制按活伸缩。借用 superpowers（brainstorming / writing-plans / TDD / review）与收尾 eval，引用不重写。依据 ADR-0021（历史沿革 ADR-0009）。
① 何时用 / 何时不用
- 用：写 / 实现 / 改 / 重构代码；改 bug；迁移；做个功能。
- 不用（上下游边界）：产出需求走
hc-prd；产出研发方案 / 接口契约走hc-tech-design；产出测试用例走hc-test；纯文档 / 规则 / git 操作（各自 skill）。
② 吃上游（输入优先级，有则必吃、无则可独立干）
- 需求产出
docs/prds/<id>/（用户故事+AC / PRD）——有就照它对齐"做什么、怎么算做对"；没有则提示用户"要不要先走hc-prd理需求"（提示、非门禁——skill 间松耦合、可独立工作，ADR-0023），用户口述清楚也能直接干。 - 设计方案
docs/designs/<id>/design.md+api-contract.md——有方案就照方案拆任务、不重新设计；方案定死的接口 / 数据模型写码时不许擅改。 - 用户口述（无上游产物的小活）——hc-dev 自身仍走 superpowers 先 plan（brainstorming → writing-plans），那是本 skill 的内部纪律。
- 写码中发现方案有问题 → 停，回
hc-tech-design改方案（用户参与），改完再继续——不许绕过契约自行其是（防实现与设计漂移）。 - 硬门：涉及对外接口 / 数据模型设计而无契约 → 先走
hc-tech-design产出技术设计 + 接口契约，再按契约落码（接口 / schema 怎么定是设计阶段的事，hc-dev 只按既定契约实现）。
③ 编制怎么定（按改动面伸缩）
- 拆分依据 = 被管工程的真实分层：从项目结构 / 模块地图 / 设计方案拿（前端 / 后端 / 客户端是常见例、不硬编 worker 种类，项目没有的层不凑——rule-0015 同款源驱动）。
- 单层小活 / 改 bug：总监直做或派 1 个
hc-dev-worker（不为琐事 spawn 编队）。 - 跨层大活：按层并行派多个
hc-dev-worker——一种 worker 类型、多实例按层派，不为每层造专职 agent。 - 契约为接缝：并行的各层 worker 拿同一份
api-contract.md独立开工、互不等待（契约已在设计阶段定死——这正是单独出契约的意义）；契约没覆盖的跨层接缝 → 回hc-tech-design补契约再并行。 - 并行纪律：worker 界限按层 / 目录 disjoint（天然不重叠，防踩踏）；worker 继承 ④ 全程纪律，决策点上报总监、由总监问用户。
- 深度信号（命中任一 → 上仪式：brainstorm 把"做成啥"聊清楚 +
superpowers:writing-plans正式 plan + 收尾 eval）：动核心逻辑 / 对外接口 / 不可逆操作（删数据、改 schema、迁移）/ 要写 ADR / 关联多且不明确 / 需要读很多才能动手 / 用户可见行为变化。无论深浅，动手前 plan（拆任务 + 编制）都要你确认。 - 怎么派：Claude Code 用 workflow / Task（
agent(..., {agentType: 'hc-dev-worker'})并行）；Codex 用其原生子 agent 机制派同名双栈 worker（可能串行，角色一致）。子模式活（改 bug / 重构 / 迁移）委派 worker 时，派单必附 ⑥ 对应子模式的步骤口径——不靠 worker 自悟、不靠总监临场转述。
④ 全程纪律（总监与 worker 都常开，不可省）
- 不假设：信息不足 → 去查事实源（仓内代码 / 资产 / 文档）或摆出来问你确认，绝不拿"已有信息 + 想要的结果"硬编（rule-0008）。
- 决策点停下问你：方案分叉、取舍、不可逆动作前，停下来问，允许多轮沟通——不自作主张猜测（worker 命中 → 上报总监问你）。
- 防技术债：边写边盯——别留 TODO 黑洞、别复制粘贴、别绕过既有抽象图省事；发现欠债当场记或当场还。
- TDD 优先：优先先写能失败的测试再实现（
superpowers:test-driven-development，引用不重写）；修 bug 必先红测试（见 ⑥）。 - 验证如实：
blocked/skipped不当 pass（rule-0002）；没真实运行证据不声称完成（rule-0003）。 - 写完提醒你测：自查与挑刺过后，把人工测试交回给你（见 ⑦）。
- UI/UX 视觉还原（涉视觉还原时）：
- 边写边看渲染结果——起本地预览 / 浏览器，不写完脑补。
- 校验用视觉两件套——渲染截图 ↔ 设计稿 / 原型对布局与观感，＋浏览器 inspect 读计算后样式核精确值（颜色 / 字号 / 间距）。
- 状态过全——四态 + hover / 禁用，原型可点的照点。
- 「读源码觉得对」= 不算验证——无渲染证据不许声称"还原了"（rule-0009：视觉产物的真实信号是像素不是源码）。
- 工具按平台现实（Claude Code 的 preview / 浏览器工具；无渲染工具则请你把它跑起来供截图）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 76 lines · 251 tokens per session scan A 91de24243372
hc-dev is a skill published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 251 tokens to every session and 3,475 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…