Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/iyuenan3/worklog-kit/pitfallsnpx skills add iyuenan3/worklog-kit --skill pitfallsgit clone --depth 1 https://github.com/iyuenan3/worklog-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iyuenan3/worklog-kit/pitfalls)<a href="https://agentmods.dev/skills/iyuenan3/worklog-kit/pitfalls"><img src="https://agentmods.dev/badge/skills/iyuenan3/worklog-kit/pitfalls.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00127 | $0.02080 |
| Opus 5 | $0.00063 | $0.01040 |
| Sonnet 5 | $0.00025 | $0.00416 |
| Haiku 4.5 | $0.00013 | $0.00208 |
Grade A, and why
pitfalls scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pitfalls：分层工程踩坑库
同一个坑，不该让不同项目各踩一遍。
Skill 代码与可变记忆分离：
- 公共基线随 Skill 发布，只放已验证、已脱敏、对其他用户也有价值的通用坑。
- 私人跨项目坑库存放在
~/.local/share/pitfalls-memory/LIBRARY.md，是默认晋级目标。 - 证据不足或已经退役的观察保存在
references/HISTORY.md，不参与默认检索和 Hook 注入。 - 单项目坑留在该项目的专用 memory，或由
$stash管理。 - Agent 自动 memory 只作低优先级提示，不是真相源。
核心纪律：渐进披露
高风险工程任务开始前，运行：
bash ~/.agents/skills/pitfalls/scripts/resolve-libraries.sh
它按顺序返回：
- Skill 自带的公共基线
references/LIBRARY.md。 - 私人
pitfalls-memory/LIBRARY.md，不存在时跳过。
只读取与当前任务对应的 ## 章节，不全量加载整座库。随后按需读取项目 memory；只有这些策展来源仍不足时，才使用当前客户端已经提供或可以检索的 Agent memory。不要主动全量扫描 Agent 的内部 memory 目录。
Codex 的全局 always-on 纪律放在 ~/.codex/AGENTS.md。Claude Code 在 ~/.claude/CLAUDE.md 保留语义一致的规则。Skill description 只是触发线索，不能替代全局纪律。
Codex 自动上下文（可选）
Codex 支持在 UserPromptSubmit 阶段追加上下文。安装本 Skill 后，可让每条用户消息自动经过同一套分层检索：
python3 ~/.agents/skills/pitfalls/scripts/install-codex-hook.py --install
python3 ~/.agents/skills/pitfalls/scripts/install-codex-hook.py --check
安装器只合并 ~/.codex/hooks.json，保留其他 Hook；修改已有文件前创建北京时间戳备份。安装后重启 Codex，并用 /hooks 审阅和信任命令。
自动加载器遵守四条边界：
- 只读、失败放行，不初始化目录、不迁移旧记忆、不修改任何库。
- 公共和私人坑库只注入与当前 prompt 相关的
###条目。 - 项目 memory 只注入
MEMORY.md相关索引行与 topic 的 frontmatterdescription，正文按项目 memory Skill 再读，避免自动带入凭证等私密正文。 - 自动上下文有长度上限，并明确标注为可能过时的策展证据，不覆盖用户当前指令和真实系统证据。
Hook 是 Codex 专属增强。Claude Code 继续通过本 Skill 的手动分层检索使用同一套公共、私人和项目记忆。
高危域：
| 域 | 典型动作 |
|---|---|
| Agent 工具与运行环境 | 编辑大文件、解释工具返回值、处理沙箱或 harness 差异 |
| Bash / Shell | 写脚本、heredoc、管道、依赖 grep 或 lsof 等命令的退出码 |
| macOS 特有 | grep 或 sed 处理中文、校验脚本、Python 包、目录判断 |
| Python / 打包与运行时 | venv、package-data、受限 cwd |
| Git | 删除与修改混合提交、历史改写、批量 add、变异测试 |
| 部署 / 基础设施 | HTTPS、Docker、反向代理、systemd、网络可达性 |
| 配置 / 凭证加载 | .env、SDK 重试、长连接 |
| 验证 / 度量 | A/B 基线、变异测试、假绿 |
| 进程 / 子进程 | 进程组、孙进程、优雅停机 |
| 文件同步 | iCloud 或网盘同步开发目录 |
查不到对应坑不等于没有坑，只表示现有知识尚未覆盖。
查（默认动作）
- 用
resolve-libraries.sh取得公共基线与私人坑库。 - 在两份库中定位相关
##章节，核对触发条件、工具版本、OS、locale 和把握度。 - 检查当前 repo 的
AGENTS.md与.agents/skills/。存在专用 memory Skill 时按其路由读取；否则运行$stash的 resolver，完整读MEMORY.md后只读相关条目。 - 策展来源仍不足时，才参考当前 Agent 提供的自动 memory，并把它视为可能过时的提示。
- 把可复用的“正确做法”落实到即将执行的命令、代码或验证策略中，再行动。
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 272 B
- assets/private-library-template.md 359 B
- references/HISTORY.md 2.3 KB
- references/LIBRARY.md 43 KB
- scripts/codex-memory-context.py 13 KB runs code
- scripts/init-private-library.sh 1.2 KB runs code
- scripts/install-codex-hook.py 4.7 KB runs code
- scripts/resolve-libraries.sh 1.1 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 138 lines · 127 tokens per session scan A 15dd7dae8339
pitfalls is a skill published in the GitHub repository iyuenan3/worklog-kit (11 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 127 tokens to every session and 2,080 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mem0-oss-to-platform
Plan and then execute a migration of a project from the mem0 open-source / self-hosted SDK (the local Memory class) to the mem0 Platform / hosted / managed SDK (the MemoryClient class). Use this whenever a developer wants to move, switch, or migrate their mem0 usage off OSS/self-hosted to the hosted API — e.g.…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
auditing-subgroup-fairness
Audit an OpenMed NER or de-identification model for performance disparities across demographic subgroups (sex, age band, race/ethnicity when available) using openmed.eval.fairnessreport. Use when the user wants per-subgroup recall and leakage, wants to check whether de-identification under-protects a group, wants to…
agent-memory
../../../engineering/agent-memory/skills/agent-memory/SKILL.md.
memory
Use when the user asks to remember, recall, forget, update, search, or inspect durable OpenSquilla memory, including profile facts in USER.md and long-term notes in MEMORY.md or memory//.md.
ha-data-stores
Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…