Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/joe-rq/harness-lab/source-command-first-reqnpx skills add Joe-rq/harness-lab --skill source-command-first-reqgit clone --depth 1 https://github.com/Joe-rq/harness-labWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joe-rq/harness-lab/source-command-first-req)<a href="https://agentmods.dev/skills/joe-rq/harness-lab/source-command-first-req"><img src="https://agentmods.dev/badge/skills/joe-rq/harness-lab/source-command-first-req.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00042 | $0.01331 |
| Opus 5 | $0.00021 | $0.00665 |
| Sonnet 5 | $0.00008 | $0.00266 |
| Haiku 4.5 | $0.00004 | $0.00133 |
Grade A, and why
source-command-first-req scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
source-command-first-req
Use this skill when the user asks to run the migrated source command first-req.
Command Template
/first-req
目标
引导新用户快速创建第一个 REQ,降低接入摩擦。
前置检查
- 确认
requirements/目录存在。不存在 → 提示先运行/harness-setup - 选择已安装的 REQ CLI 入口:
package.json中存在req:create→ 使用npm run req:create -- ...- 否则存在
scripts/req-cli.mjs→ 使用node scripts/req-cli.mjs create ... - 两者都不存在 → 提示先运行
/harness-setup
- 用对应入口执行
npm run req:status或node scripts/req-cli.mjs status,确认当前 worktree 无活跃 REQ;有活跃 REQ 时先完成/搁置,或改用 worktree 流程。
执行步骤
Step 1: 项目类型识别
通过以下信号自动识别项目类型:
| 信号 | 项目类型 |
|---|---|
存在 package.json + react 依赖 |
React |
存在 package.json + next 依赖 |
Next.js |
存在 package.json + vue 依赖 |
Vue |
存在 pyproject.toml 或 setup.py |
Python |
存在 go.mod |
Go |
存在 Cargo.toml |
Rust |
| 以上都不匹配 | Generic |
Step 2: 用 AskUserQuestion 询问 REQ 主题
使用 AskUserQuestion 工具,提供 3 个推荐选项 + 自定义输入:
推荐选项根据项目类型生成:
- React/Next.js 项目:组件开发、状态管理、API 集成
- Python 项目:数据处理、API 开发、测试覆盖
- Go 项目:性能优化、并发处理、API 开发
- Generic:Bug 修复、功能开发、代码重构
主题可以使用中文或其他非 ASCII 文字。CLI 会保留原始标题;如果标题无法生成英文 slug,会使用安全的 requirement 文件名后缀,不要求用户手工翻译。
同时确认本次 REQ 的真实验证入口:
- 先读取项目已有配置(如
package.jsonscripts、pyproject.toml、go.mod、Cargo.toml、CI 或项目 README)。 - 只推荐仓库中确实存在或用户明确确认的命令。
- 无法确认时填写“待补充真实验证命令”,不得把
npm test、pytest、go test ./...或cargo test当作默认事实。
Step 3: 创建 REQ
根据前置检查选择的入口运行。标题可以直接使用用户原文,不需要为了中文标题额外传 --slug:
npm run req:create -- --title "[用户选择的主题]"
# 没有 package.json alias,但已安装 CLI 时
node scripts/req-cli.mjs create --title "[用户选择的主题]"
Step 4: 自动填充 REQ 内容
创建完成后,自动读取生成的 REQ 文件,填充以下内容:
背景:基于项目类型和主题生成一段简短描述。
目标:根据主题类型推荐 2-3 个目标。
验收标准:根据主题类型推荐 2-3 个可验证的标准。
验证计划:填入 Step 2 已确认的真实命令、环境依赖和人工验证;如果还没有可信命令,明确记录缺口并在 req:start 前由用户补齐。
主题与字段映射:
| 主题类型 | 推荐目标 | 推荐验收标准 |
|---|---|---|
| 组件开发 | 实现组件、编写测试、补充文档 | 组件可渲染、测试通过、Storybook 可用(仅在项目已配置时) |
| Bug 修复 | 定位根因、实现修复、回归测试 | Bug 不再复现、回归测试通过 |
| API 开发 | 实现端点、参数校验、错误处理 | API 可调通、4xx/5xx 处理正确 |
| 测试覆盖 | 识别未覆盖路径、编写测试 | 覆盖率提升至目标值 |
| 代码重构 | 消除重复、改善命名、保持行为 | 重构后测试仍通过 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 121 lines · 42 tokens per session scan A ae23bcbf21b5
source-command-first-req is a skill published in the GitHub repository Joe-rq/harness-lab (20 stars, last pushed 21d ago), licensed MIT. It adds 42 tokens to every session and 1,331 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…