Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-deploygit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-deploy)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-deploy"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-deploy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-deploy"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-deploy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 17 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 17 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00010 | $0.01310 |
| Opus 5 | $0.00005 | $0.00655 |
| Sonnet 5 | $0.00002 | $0.00262 |
| Haiku 4.5 | $0.00001 | $0.00131 |
Grade A, and why
pdlc-deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
创建部署文档
⛔ 部署面向生产、不可逆·外发：真实执行部署属破坏性范畴。
--autonomous对涉及真实部署动作的环节无效——仍必须人工显式确认。本命令默认只产出部署文档，不代表授权自动上线。
为指定服务或应用创建部署手册。
PDLC 前置检查（必须执行，不可跳过）
- 从用户输入中提取服务/功能名称关键词
- 在
docs/07_reviews/code/目录下搜索包含该关键词的评审记录- 匹配新格式：
F<日期>-<编号>-*<关键词>*-review.md - 匹配旧格式：
YYYYMMDD-*<关键词>*-review.md - 同时检查文件内容中是否包含该关键词
- 匹配新格式：
- 未找到评审记录 → 输出以下信息后立即停止，不继续执行：
⛔ PDLC 守卫：未找到与「<功能名>」相关的评审记录。 部署文档必须基于已完成评审的代码。请先运行： 👉 /pdlc-review <评审目标> - 找到 → 提取功能ID（如
F20260326-090000），读取评审记录内容，继续执行
工作流程
- 阅读目标服务/应用的 README.md 和技术栈信息
- 阅读
docs/02_design/architecture/下的架构设计文档（如有） - 阅读评审记录，确认功能状态
- 【必须创建文件】 在
docs/05_deployment/guides/下创建部署手册- 使用模板:
templates/deploy-doc-template.md（结构完整、章节齐全） - 文件名格式:
<功能ID>-<功能名>-deploy.md（如F20260326-090000-user-auth-deploy.md）- 若无功能ID，则使用旧格式
YYYYMMDD-<服务名>-deploy.md
- 若无功能ID，则使用旧格式
- 文档顶部必须包含 PDLC 追溯头：
<!-- PDLC-TRACE --> <!-- 功能ID: F20260326-090000 --> <!-- 功能名称: user-auth --> <!-- 阶段: 部署 --> <!-- 前置文档: docs/07_reviews/code/F20260326-090000-user-auth-review.md -->
- 使用模板:
文档内容
- 前置条件（环境要求、依赖服务）
- 环境配置（环境变量、配置文件）
- 构建步骤
- 部署步骤
- 健康检查验证
- 回滚方案
- 常见问题排查
部署文档自审与自动修复（创建后立即执行，不可跳过）
重新阅读刚创建的部署文档，逐项检查以下质量门禁：
关键章节检查
- 前置条件：是否列出了所有运行时依赖（数据库版本、中间件版本、系统配置）
- 环境变量：是否列出了每个环境变量的名称、用途、示例值、是否必填
- 构建步骤：是否可直接复制执行，无需额外推断
- 部署步骤：是否区分了首次部署与升级部署
- 健康检查：是否定义了健康检查 URL、预期响应、超时时间
- 回滚方案：是否有明确的回滚步骤（不是简单写「回滚到上一版本」）
- 数据库迁移：如涉及 DB 变更，是否有迁移执行和回滚步骤
- 常见问题排查：是否有至少 3 个常见错误场景及解决方案
可执行性检查
- 所有命令是否完整可复制（无省略号
...、无占位符未说明） - 端口号、域名、路径是否使用了变量或占位符并在前置条件中说明
- 步骤顺序是否合理（不会因顺序错误导致部署失败）
自动修复
- 缺失的健康检查：根据服务类型（HTTP/gRPC）自动补充标准健康检查配置
- 缺失的回滚方案：自动补充基于版本的回滚步骤模板
- 缺失的环境变量说明：从代码中扫描
process.env/os.Getenv/System.getenv等，自动补充 - 模糊的操作步骤：改写为具体命令
- 缺失的常见问题：自动补充 3 个通用排查项（端口占用、权限不足、依赖不可达）
- 修复后在文档末尾追加审查记录：
## 自审记录 - 审查时间：<ISO 8601> - 发现问题：X 项 - 自动修复：X 项 - 修复明细： - [已修复] <问题描述>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 113 lines · 10 tokens per session scan A 0706c6386763
pdlc-deploy is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed today), licensed MIT. It adds 10 tokens to every session and 1,310 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
postgres-database-migration
Use this skill for planning, testing, and safely executing PostgreSQL schema migrations — especially when working with production data or shared databases. Trigger when user asks to: Test a schema migration before applying it to production Add, remove, or rename columns safely on a live table Change a column's data…
setup-timescaledb-hypertables
Use this skill when creating database schemas or tables for Timescale, TimescaleDB, TigerData, or Tiger Cloud, especially for time-series, IoT, metrics, events, or log data. Use this to improve the performance of any insert-heavy table. Trigger when user asks to: Create or design SQL schemas/tables AND…
design-postgis-tables
Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications.
migrate-postgres-tables-to-hypertables
Use this skill to migrate identified PostgreSQL tables to Timescale/TimescaleDB hypertables with optimal configuration and validation. Trigger when user asks to: Migrate or convert PostgreSQL tables to hypertables Execute hypertable migration with minimal downtime Plan blue-green migration for large tables Validate…
pgvector-semantic-search
Use this skill for setting up vector similarity search with pgvector for AI/ML embeddings, RAG applications, or semantic search. Trigger when user asks to: Store or search vector embeddings in PostgreSQL Set up semantic search, similarity search, or nearest neighbor search Create HNSW or IVFFlat indexes for vectors…
find-hypertable-candidates
Use this skill to analyze an existing PostgreSQL database and identify which tables should be converted to Timescale/TimescaleDB hypertables. Trigger when user asks to: Analyze database tables for hypertable conversion potential Identify time-series or event tables in an existing schema Evaluate if a table would…