Borrowing it
Nothing to install: this file belongs to Joe-rq/harness-lab. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Joe-rq/harness-lab/master/.agents/skills/source-command-first-req/SKILL.mdgit clone --depth 1 https://github.com/Joe-rq/harness-labWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joe-rq/harness-lab/source-command-first-req)<a href="https://agentmods.dev/skills/joe-rq/harness-lab/source-command-first-req"><img src="https://agentmods.dev/badge/skills/joe-rq/harness-lab/source-command-first-req/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joe-rq/harness-lab/source-command-first-req"><img src="https://agentmods.dev/badge/skills/joe-rq/harness-lab/source-command-first-req.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01331 |
| Opus 5.5 | $0.00017 | $0.00532 |
| Sonnet 5.5 | $0.00008 | $0.00266 |
| Haiku 4.5 | $0.00004 | $0.00133 |
Grade A, and why
source-command-first-req scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
source-command-first-req
Use this skill when the user asks to run the migrated source command first-req.
Command Template
/first-req
目标
引导新用户快速创建第一个 REQ,降低接入摩擦。
前置检查
- 确认
requirements/目录存在。不存在 → 提示先运行/harness-setup - 选择已安装的 REQ CLI 入口:
package.json中存在req:create→ 使用npm run req:create -- ...- 否则存在
scripts/req-cli.mjs→ 使用node scripts/req-cli.mjs create ... - 两者都不存在 → 提示先运行
/harness-setup
- 用对应入口执行
npm run req:status或node scripts/req-cli.mjs status,确认当前 worktree 无活跃 REQ;有活跃 REQ 时先完成/搁置,或改用 worktree 流程。
执行步骤
Step 1: 项目类型识别
通过以下信号自动识别项目类型:
| 信号 | 项目类型 |
|---|---|
存在 package.json + react 依赖 |
React |
存在 package.json + next 依赖 |
Next.js |
存在 package.json + vue 依赖 |
Vue |
存在 pyproject.toml 或 setup.py |
Python |
存在 go.mod |
Go |
存在 Cargo.toml |
Rust |
| 以上都不匹配 | Generic |
Step 2: 用 AskUserQuestion 询问 REQ 主题
使用 AskUserQuestion 工具,提供 3 个推荐选项 + 自定义输入:
推荐选项根据项目类型生成:
- React/Next.js 项目:组件开发、状态管理、API 集成
- Python 项目:数据处理、API 开发、测试覆盖
- Go 项目:性能优化、并发处理、API 开发
- Generic:Bug 修复、功能开发、代码重构
主题可以使用中文或其他非 ASCII 文字。CLI 会保留原始标题;如果标题无法生成英文 slug,会使用安全的 requirement 文件名后缀,不要求用户手工翻译。
同时确认本次 REQ 的真实验证入口:
- 先读取项目已有配置(如
package.jsonscripts、pyproject.toml、go.mod、Cargo.toml、CI 或项目 README)。 - 只推荐仓库中确实存在或用户明确确认的命令。
- 无法确认时填写“待补充真实验证命令”,不得把
npm test、pytest、go test ./...或cargo test当作默认事实。
Step 3: 创建 REQ
根据前置检查选择的入口运行。标题可以直接使用用户原文,不需要为了中文标题额外传 --slug:
npm run req:create -- --title "[用户选择的主题]"
# 没有 package.json alias,但已安装 CLI 时
node scripts/req-cli.mjs create --title "[用户选择的主题]"
Step 4: 自动填充 REQ 内容
创建完成后,自动读取生成的 REQ 文件,填充以下内容:
背景:基于项目类型和主题生成一段简短描述。
目标:根据主题类型推荐 2-3 个目标。
验收标准:根据主题类型推荐 2-3 个可验证的标准。
验证计划:填入 Step 2 已确认的真实命令、环境依赖和人工验证;如果还没有可信命令,明确记录缺口并在 req:start 前由用户补齐。
主题与字段映射:
| 主题类型 | 推荐目标 | 推荐验收标准 |
|---|---|---|
| 组件开发 | 实现组件、编写测试、补充文档 | 组件可渲染、测试通过、Storybook 可用(仅在项目已配置时) |
| Bug 修复 | 定位根因、实现修复、回归测试 | Bug 不再复现、回归测试通过 |
| API 开发 | 实现端点、参数校验、错误处理 | API 可调通、4xx/5xx 处理正确 |
| 测试覆盖 | 识别未覆盖路径、编写测试 | 覆盖率提升至目标值 |
| 代码重构 | 消除重复、改善命名、保持行为 | 重构后测试仍通过 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 121 lines · 42 tokens per session scan A ae23bcbf21b5
source-command-first-req is a skill published in the GitHub repository Joe-rq/harness-lab (23 stars, last pushed 1mo ago), licensed MIT. It adds 42 tokens to every session and 1,331 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…