swe-knowledge

swe-knowledge is a skill for Claude Code from HsuanYuLee/polaris. It costs 232 tokens per session (8,334 once invoked), scanned A, original, MIT.

A shared definition of done for software changes. It says that code should live on a branch, have a pull request, pass review before entering the default branch, and pass local checks before being pushed.

In plain words
What is it for?
Use it when deciding whether a code change is ready for review and integration, including local type checks, linting, tests, smoke tests, and responses to reviewer comments.
Why use it?
It prevents a change from being called complete merely because the code works locally or its acceptance checks pass.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: reads .claude/ paths.

Good fit Use it when deciding whether a code change is ready for review and integration, including local type checks, linting, tests, smoke tests, and responses to reviewer comments.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/hsuanyulee/polaris/swe-knowledge
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add HsuanYuLee/polaris --skill swe-knowledge
Clone the repo
git clone --depth 1 https://github.com/HsuanYuLee/polaris

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for swe-knowledge

README.md
[![agentmods](https://agentmods.dev/badge/skills/hsuanyulee/polaris/swe-knowledge.svg)](https://agentmods.dev/skills/hsuanyulee/polaris/swe-knowledge)
Your own site
<a href="https://agentmods.dev/skills/hsuanyulee/polaris/swe-knowledge"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/swe-knowledge.svg" alt="Measured on agentmods" height="20"></a>
Per session 232 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 8,334 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 2 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Prompt Injection · line 136
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
  • high Prompt Injection · line 136
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00232 $0.08334
Opus 5 $0.00116 $0.04167
Sonnet 5 $0.00046 $0.01667
Haiku 4.5 $0.00023 $0.00833

Measured yesterday against content hash 1caf94e24f22, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

swe-knowledge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

The scan reads SKILL.md. This mod also ships 12 executable files (scripts/check-swe-delivered.sh, scripts/check-swe-done.sh, scripts/check-swe-precondition.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/swe-knowledge/SKILL.md · 393 lines

How it starts

The opening of the file, as written. The whole thing — 393 lines — stays where its author put it; the contents beside it link to each section on GitHub.

swe-knowledge — 軟體工程的 Definition of Done

這裡放的是所有增量共用的完成條件。跟每張單獨有的驗收條件(acceptance criteria)分得很 開:AC 寫在那張單凍結的 assertion 裡,DoD 寫在這裡。一張單可以通過全部 AC 卻沒有 done—— assertion 全綠但改動還躺在預設分支上、沒有任何人看得到它,就是那個情況。

所以這幾條不要抄進任何一張單的凍結區。抄進去等於每張單都重簽一次同樣幾行不承載新資訊的 東西,而漏抄的那一張就靜默地少了一條完成條件。

五條

  1. 改動住在一條 branch 上,不躺在預設分支。 開的時機是「判定要立案之後、動手之前」—— 一個還沒開工的成功定義直接躺在預設分支上,等於它已經是既成事實。

  2. 有一個 PR。 PR 開出來就是實作完成:它是那份改動變成可被別人看見、可被判定的 東西的那一刻。沒有 PR 的改動不管本機多綠都還沒 done。

  3. 判定過才進預設分支。 進去的路徑是那個 PR,不是直接推。

  4. push 之前,本機跑完跑得動的驗證。 type check、lint、單元測試、受影響路徑的冒煙。 把 CI 當第一道防線等於把 reviewer 當驗證工具。

  5. reviewer 提的每一條,處置回到那條意見上。 不是「有沒有處理」——是提出者拿不拿 得到那個處置。他看的是他留言的地方,回在別處他收不到。

    處置有四種:照做、回覆說明為什麼不照做、拒絕、另外開單。照做不是預設。「處置」這個 字是中性的,而它常被讀成「照做」。一條意見可以是對的、而仍然不該在這一輪做;也可以是 這個 repo 根本不做那件事。讀成「照做」的話,這一條會把每一則意見都變成一次施工。

    每一串都算,nit 也算。 「妥善處理」的量法是:每一串的最後一則是作者,而且那一則說出了 四種處置裡的哪一種。標成 nit 的意見只是提出者在說「這條不擋你」,不是在說「這條不用回」。

第 2 條有一個這個 repo 自己的教訓:2026-08-03,「開 PR」這個能力在腳本歸位時被刪掉,因為 它在三站裡沒有主人;43 分鐘後有人寫了一句跟腳本矛盾的散文把洞蓋住,於是「PR 算不算完成」 有兩個互相矛盾的答案在流通。現在它有主人了,就是這一條。

第 5 條是同一個形狀又發生了一次。2026-08-11:一個 PR 收到三位 reviewer 的意見,全部查證、 修掉、assertion 重跑全綠,也回了另一個系統的訊息串——但那個 PR 上一則回覆都沒有,是人自己 發現的(「我好像沒有在 PR 上看到你怎麼處理的」)。偵測有主人(誰欠我回覆、誰欠我審查, 都有東西在算),動作沒有主人。而「還沒被 approve」這個狀態,跟「我還沒動手」長得 一模一樣。

在程式碼裡,「你寫下的話」長成什麼樣子

engineering 那條「送審之前把自己寫下的話跟行為對一遍」在這一類工作裡有具體形狀。這幾樣 都是對行為的主張,都會跟實作分開演化,而編譯器與測試都不會抓:

  • doc-comment 的第一句——通常是最早寫下的,也最可能是舊設計的化石。
  • 型別宣告(參數型別、回傳型別、介面欄位)——宣告成數字就不能送出字串。它是契約, 不是提示;改了寫入路徑要回頭看宣告。
  • 名字——一個叫「處理中」的狀態要真的在事情處理中的時候是真的。
  • 形狀——把等待用的結構套在一個不會等待的呼叫上(例如包住一個同步呼叫),會讓一段 沒有等待的程式碼長得像在等待,而讀的人依樣相信它。

第 4 條那句「本機跑完跑得動的驗證」的另一半就是這個:跑得動的用跑的,跑不動的用讀的。 一句說謊的 doc-comment 跑不出紅燈,它只會在下一個人依它行事的時候生效。

所以寫的時候就要讓它值得被讀:

  • 新增或修改的 function 要有 doc-comment(TSDoc / JSDoc / Google-style docstring / shell function header),說明它做什麼、參數與回傳值是什麼。既有沒動的不強制回填——上面 那句「最可能是舊設計的化石」講的就是它們,補一句猜出來的比空著糟。
  • 帶業務意義的 literal 抽成有名字的常數,名字說不完的在宣告處補一行。名字也是一句 對行為的主張,同一條規矩適用。純視覺數值(padding、gap)與 aria-label 這類不強制。
  • Inline comment 只在「為什麼」不自明時寫,一短行。 逐行解說「做什麼」是會說謊的 雜訊:它貼著那一行,那一行改了它不會跟著改。

Read the full file on GitHub · 393 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +36 lines 1caf94e24f22
  2. 2d ago Changed · +9 lines 1499bed22459
  3. 8d ago First seen · 348 lines · 232 tokens per session scan A 9d6c0f55a348

Subscribe to this mod's changes

swe-knowledge is a skill published in the GitHub repository HsuanYuLee/polaris (5 stars, last pushed today), licensed MIT. It adds 232 tokens to every session and 8,334 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

git-workflow

A guide for handling Git repository work safely, including status checks, branches, commits, pushes, pull requests, and rebasing. Git is a version-control system that records code changes and coordinates work between developers.

laolaoshiren/claude-code-skills-zh · 73 tokens

changelog-gen

A changelog generator that turns Git history into a version-by-version record of project changes. A changelog is a readable summary of new features, fixes, breaking changes, documentation, and other updates.

laolaoshiren/claude-code-skills-zh · 19 tokens

resolve-pr-comments

Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments. Handles both change requests (fix or skip) and reviewer questions (explain using reasoning recalled from past Claude Code transcripts). Use when the user asks to "resolve PR comments", "fix review comments", "address PR…

tobihagemann/turbo · 95 tokens

create-pr

Create a GitHub pull request with a drafted title and description. Use when the user asks to "create a PR", "create a pull request", "open a PR", or "submit a PR".

tobihagemann/turbo · 44 tokens

update-pr

Update an existing GitHub pull request's title and description to reflect the current state of the branch. Use when the user asks to "update the PR", "update PR description", "update PR title", "refresh PR description", or "sync PR with changes".

tobihagemann/turbo · 56 tokens

changelog-rules

Shared changelog conventions and formatting rules referenced by /create-changelog and /update-changelog. Not typically invoked directly.

tobihagemann/turbo · 29 tokens