Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-adoptgit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-adopt)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-adopt"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-adopt/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-adopt"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-adopt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 17 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 17 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.03173 |
| Opus 5 | $0.00006 | $0.01587 |
| Sonnet 5 | $0.00002 | $0.00635 |
| Haiku 4.5 | $0.00001 | $0.00317 |
Grade A, and why
pdlc-adopt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 307 lines — stays where its author put it; the contents beside it link to each section on GitHub.
旧项目接入 PDLC
扫描现有项目结构，逆向生成基线文档，并进行健康检查发现潜在问题。让旧项目平滑接入 PDLC 流程。
核心原则
- 只生文档，不动代码：不修改任何现有代码，仅生成基线文档
- 增量接入：旧代码标记为"已接入基线"，只有新功能走完整 PDLC
- 守卫畅通：生成的基线文档满足守卫检查，后续命令不再被阻断
子命令解析
从 $ARGUMENTS 中解析子命令：
| 子命令 | 说明 |
|---|---|
scan |
扫描项目，输出接入报告 + 健康检查报告（不写任何文件，只读分析） |
init |
根据扫描结果，逆向生成基线文档到 docs/ 目录 |
如果未提供子命令或无法识别，输出以上帮助信息后停止。
scan 子命令
全程只读，不创建/修改任何文件，只在终端输出报告。
第一步：项目结构识别
-
技术栈检测
- 检查特征文件：
package.json、pom.xml、build.gradle、go.mod、requirements.txt、Pipfile、Cargo.toml、mix.exs等 - 识别框架：Spring Boot、Express、NestJS、FastAPI、Gin、Echo、Django、Rails 等
- 检查前端框架：
react、vue、next、angular（从 package.json 依赖推断）
- 检查特征文件：
-
服务/应用识别
- 微服务：扫描
backend/services/或具有独立启动入口的子目录 - 单体服务：根目录即为服务
- 前端应用：扫描
frontend/、web/、app/或具有前端框架特征的目录 - 记录每个服务/应用的名称、技术栈、入口文件
- 微服务：扫描
-
数据库识别
- 从配置文件推断数据库类型（MySQL/PostgreSQL/MongoDB/Redis 等）
- 扫描 ORM 配置（TypeORM/Sequelize/GORM/SQLAlchemy/MyBatis/JPA 等）
- 检查已有 migration 目录
第二步：API 接口提取
按技术栈扫描路由定义：
| 技术栈 | 扫描目标 |
|---|---|
| Spring Boot | @RequestMapping、@GetMapping、@PostMapping 等注解 |
| Express/NestJS | router.get/post/put/delete、@Get/@Post 装饰器 |
| FastAPI | @app.get/post/put/delete、@router.get/post |
| Go (Gin/Echo) | r.GET/POST/PUT/DELETE、e.GET/POST |
| Django | urlpatterns、path()、re_path() |
提取信息：HTTP 方法、路径、处理函数名、参数（如能识别）。
第三步：数据库结构提取
| 来源 | 提取方式 |
|---|---|
| ORM Model | 扫描实体类/模型定义，提取表名、字段名、字段类型、关联关系 |
| Migration 文件 | 扫描 migrations/、db/migrate/ 等目录，提取 DDL 变更历史 |
| SQL 文件 | 扫描 *.sql 文件，提取 CREATE TABLE 语句 |
第四步：已有文档检测
- 检查
README.md内容丰富度 - 检查
docs/目录及子目录 - 检查是否已有 PDLC 文档（
docs/01_requirements/、docs/02_design/等） - 如已有 PDLC 文档，标记为"已存在，跳过生成"
第五步：健康检查（潜在问题扫描）
对代码进行静态分析级别的检查，按严重程度分级：
🔴 阻断级（必须修复才能安全上线）
- 安全漏洞
- SQL 拼接（字符串拼接构建 SQL 而非参数化查询）
- 硬编码密钥/密码（代码中直接写死的 secret、password、api_key）
- 未鉴权的敏感接口（涉及用户数据的接口无鉴权中间件）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 307 lines · 12 tokens per session scan A e6ffa531c5d0
pdlc-adopt is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed yesterday), licensed MIT. It adds 12 tokens to every session and 3,173 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
postgres-database-migration
Use this skill for planning, testing, and safely executing PostgreSQL schema migrations — especially when working with production data or shared databases. Trigger when user asks to: Test a schema migration before applying it to production Add, remove, or rename columns safely on a live table Change a column's data…
setup-timescaledb-hypertables
Use this skill when creating database schemas or tables for Timescale, TimescaleDB, TigerData, or Tiger Cloud, especially for time-series, IoT, metrics, events, or log data. Use this to improve the performance of any insert-heavy table. Trigger when user asks to: Create or design SQL schemas/tables AND…
design-postgis-tables
Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications.
migrate-postgres-tables-to-hypertables
Use this skill to migrate identified PostgreSQL tables to Timescale/TimescaleDB hypertables with optimal configuration and validation. Trigger when user asks to: Migrate or convert PostgreSQL tables to hypertables Execute hypertable migration with minimal downtime Plan blue-green migration for large tables Validate…
pgvector-semantic-search
Use this skill for setting up vector similarity search with pgvector for AI/ML embeddings, RAG applications, or semantic search. Trigger when user asks to: Store or search vector embeddings in PostgreSQL Set up semantic search, similarity search, or nearest neighbor search Create HNSW or IVFFlat indexes for vectors…
find-hypertable-candidates
Use this skill to analyze an existing PostgreSQL database and identify which tables should be converted to Timescale/TimescaleDB hypertables. Trigger when user asks to: Analyze database tables for hypertable conversion potential Identify time-series or event tables in an existing schema Evaluate if a table would…