Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-featuregit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-feature)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-feature"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-feature/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-feature"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-feature.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 20 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 20 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.15587 |
| Opus 5.5 | $0.00012 | $0.06235 |
| Sonnet 5.5 | $0.00006 | $0.03117 |
| Haiku 4.5 | $0.00003 | $0.01559 |
Grade A, and why
pdlc-feature scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 818 lines — stays where its author put it; the contents beside it link to each section on GitHub.
全自动 PDLC 新功能开发
⛔ IRON LAW · 不可违反的硬门禁
以下规则为不可协商的执行约束：
- 文件必须落盘：所有带编号（功能ID / 缺陷ID）的文档，必须作为实际文件写入磁盘，不可仅在对话中输出。
- 阶段必须落章：每个阶段完成后必须在状态机
docs/.pdlc-state/<feature-id>.json追加 history，不可跳过。 - 测试必须存在：进入
/pdlc-implement前，对应测试必须存在且处于红灯状态。违反则中止。 - 自检必须执行：段二自检为强制步骤，不得以"已经很好了"为由跳过。
- 防循环：段三修复为单次，不递归。无法自动修复的问题记录到报告，继续往下走。
- 状态必推进：成功执行某 phase 后
current_stage必须变更。收尾时若发现current_stage未推进，视为失败并报错，不得静默返回（防止外层循环拿滞后的状态空转烧额度）。唯一例外：命中人工点主动 block 时，current_stage保持不变但必须写last_phase_result.ok=false+blocked_reason。
违反任一条 = 立即中止当前命令，输出违规详情，等待人工介入。
接收功能描述或已有需求文档，全自动走完 PDLC 所有阶段，直到产出可上线状态。唯一的提问点在开工前：文字描述太单薄时问一轮澄清（带 --autonomous 则一个都不问）；开工后中途不暂停、不询问用户。
输入解析（阶段一之前执行）
从本命令的参数中判断输入类型：
-
检测是否为文件路径：如果输入匹配以下模式之一，视为文件输入：
- 以
/、./、../、~开头的路径 - 以
.md、.txt、.docx、.pdf、.doc结尾 - 包含
docs/或requirements/路径片段 - 是一个实际存在的文件路径
- 以
-
文件输入：读取文件内容，从中提取功能描述、用户故事、验收标准。阶段一基于文件内容结构化生成 PRD（保留原始意图，补充缺失部分），而非从零推断。在 PRD 中标注：
<!-- 来源文档: <原始文件路径> --> -
文本输入：先按下文「需求澄清」对照清单，描述太单薄时问一轮（
--autonomous下不问），再从描述自动推断 -
已有 PRD 路径：如果输入指向
docs/01_requirements/prd/下已有的 PRD 文件，则跳过阶段一，直接从阶段一-B（任务拆解）或阶段二（技术设计）开始；带--lite时直接从阶段三开始。 功能ID 沿用该 PRD 追溯头里的功能ID，不另分配（PRD 没有追溯头时才按下文分配新 ID） -
按已有功能ID续跑：输入是功能ID（
F<日期>-<时分秒>）且docs/.pdlc-state/<功能ID>.json存在 → 读它的current_stage/next_step， 从下一个未完成的阶段继续（requirements完成 → 阶段二，但next_step是pdlc-tdd（轻量模式）→ 阶段三；design→ 阶段三；tdd→ 阶段四；impl→ 阶段五；review且next_step=pdlc-ship→ 已走完，只出最终报告）。 上次停在阻塞（last_phase_result.ok=false）时，先读blocked_reason：原因已消除才继续，否则报告原因后停止
需求澄清（文字输入时，写 PRD 之前执行）
只对文字输入生效。输入是文件、已有 PRD 或功能ID 时跳过本节——已有文档按原文结构化，不再追问。
参数里的 --autonomous 是开关，不是需求的一部分：先把它剥掉，剩下的才是需求描述。
1. 对照清单打勾
逐项判断用户的描述里有没有明说——看的是「写了没有」，不是「能不能猜出来」：
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago Changed · +2 lines 2ec32bca6b8f
- 15d ago Changed · +112 lines 22c426eef429
- 18d ago Changed · +59 lines 49c6ff17a0b6
- 19d ago Changed · -1 lines d9a7e5e1ed28
- 20d ago Changed · +1 lines 0332c3ffbfce
- 1mo ago Changed · +345 lines eb55495d9af0
- 1mo ago First seen · 300 lines · 30 tokens per session scan A 3061edf8d6ba
pdlc-feature is a skill published in the GitHub repository kanfu-panda/pdlc-skills (18 stars, last pushed 14d ago), licensed MIT. It adds 30 tokens to every session and 15,587 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
python-testing
Expert in Python testing with pytest and test-driven development.
execute
Dispatch and execute implementation plans with TDD and checkpoints. Use when plan is ready. Parallel by default for independent tasks.
tdd
Strict test-driven development for behavior changes. Requires verified RED before production code, minimal GREEN, and refactor only after passing tests.
specmint-tdd-html
TDD-first spec management for AI coding workflows. Use this skill when the user explicitly mentions specs, forging, or structured planning: says "forge", "forge a spec", "write a spec for X", "create a spec", "plan X as a spec", "resume", "what was I working on", "spec list/status/pause/switch/activate", "implement…
specmint-tdd
TDD-first spec management for AI coding workflows. Use this skill when the user explicitly mentions specs, forging, or structured planning: says "forge", "forge a spec", "write a spec for X", "create a spec", "plan X as a spec", "resume", "what was I working on", "spec list/status/pause/switch/activate", "implement…
tdd
Guides feature work and bug fixes through a red-green-refactor loop using vertical slices. Use when the user wants test-first development, acceptance criteria implemented safely, or one behavior delivered at a time.