Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-featuregit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-feature)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-feature"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-feature/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-feature"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-feature.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 20 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 20 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.04327 |
| Opus 5 | $0.00015 | $0.02164 |
| Sonnet 5 | $0.00006 | $0.00865 |
| Haiku 4.5 | $0.00003 | $0.00433 |
Grade A, and why
pdlc-feature scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 300 lines — stays where its author put it; the contents beside it link to each section on GitHub.
全自动 PDLC 新功能开发
接收功能描述或已有需求文档，全自动走完 PDLC 所有阶段，直到产出可上线状态，中途不暂停、不询问用户。
输入解析（阶段一之前执行）
从 $ARGUMENTS 中判断输入类型：
-
检测是否为文件路径：如果输入匹配以下模式之一，视为文件输入：
- 以
/、./、../、~开头的路径 - 以
.md、.txt、.docx、.pdf、.doc结尾 - 包含
docs/或requirements/路径片段 - 是一个实际存在的文件路径
- 以
-
文件输入：读取文件内容，从中提取功能描述、用户故事、验收标准。阶段一基于文件内容结构化生成 PRD（保留原始意图，补充缺失部分），而非从零推断。在 PRD 中标注：
<!-- 来源文档: <原始文件路径> --> -
文本输入：按原有逻辑，从一句话描述自动推断
-
已有 PRD 路径：如果输入指向
docs/01_requirements/prd/下已有的 PRD 文件，则跳过阶段一，直接从阶段一-B（任务拆解）或阶段二（技术设计）开始
执行规则
- 全程自动：不在任何阶段暂停等待确认，遇到歧义自行做合理假设并在最终报告中说明
- 严格顺序：必须按阶段一→二→三→四→五→六顺序执行，不得跳过
- 文档先行：每阶段先产出文档，再进入下一阶段
- TDD 强制：代码实现前测试必须已存在且处于失败状态
- 自查通过才结束：所有测试通过、评审记录完成后才输出最终报告
- 功能ID贯穿全程：阶段一分配功能ID后，所有后续文档和产出物统一使用该ID
功能ID分配（阶段一开始前执行）
- 获取当前日期与时分秒：
date +%Y%m%d、date +%H%M%S - 生成功能ID：
F<YYYYMMDD>-<HHMMSS>（示例形如F20260717-122801；用执行时的真实值） - 本地防撞：若该 ID 已被占用（
docs/或docs/.pdlc-state/下已有同名前缀），重新读取date +%H%M%S重取（生成本身有耗时、通常已跨秒；若仍同秒则sleep 1后再读一次，不手算时分秒，天然处理跨天边界） - 从用户描述中提取功能名关键词（英文小写+连字符，如
user-auth）
用时分秒而非当日序号，是为了多人 / 多 AI 并行时零协调也不撞号、合并零冲突。旧
F<日期>-<NN>ID 仍可解析。
关系建议（RFC#6）
分配 ID 后，扫描 docs/.pdlc-state/*.json 列出已有 feature 名，结合用户描述判断本功能与既有 feature 的关系：
- 描述含「基于 / 扩展 / 增强 X」→ 建议
extends X - 描述含「需要 / 依赖 X」→ 建议
depends_on X - 描述含「替代 / 重做 X」→ 建议
supersedes X - 命中后填入 PRD §6.1 关系表，并在阶段四状态机的
relations块写入。类型语义见relations.md - 无明显关系则跳过
阶段一：需求分析（PRD）
- 根据功能描述，自动推断：功能范围、目标用户、核心用户故事（至少 3 条）、验收标准
- 在
docs/01_requirements/prd/下创建文件，命名格式：<功能ID>-<功能名>-prd.md - 使用
templates/prd-template.md作为模板 - 文档顶部必须包含 PDLC 追溯头：
<!-- PDLC-TRACE --> <!-- 功能ID: F20260326-090000 --> <!-- 功能名称: user-auth --> <!-- 阶段: 需求 --> <!-- 前置文档: 无 --> <!-- 创建时间: 2026-03-26T10:30:00 --> - 文档须包含：背景、目标、用户故事、功能清单、验收标准、非功能要求、不在范围内的事项
🔍 阶段一质量关卡（PRD 自审，必须执行）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 300 lines · 30 tokens per session scan A 3061edf8d6ba
pdlc-feature is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 4,327 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
execute
Dispatch and execute implementation plans with TDD and checkpoints. Use when plan is ready. Parallel by default for independent tasks.
tdd
Strict test-driven development for behavior changes. Requires verified RED before production code, minimal GREEN, and refactor only after passing tests.
tdd-xfail
Use when fixing a bug through strict xfail reproduction and needing proof that the test fails for the intended reason.
tdd-fix
TDD bug-fix workflow — reproduce a bug as a failing test, find root cause, fix, and verify.
tdd
Guides feature work and bug fixes through a red-green-refactor loop using vertical slices. Use when the user wants test-first development, acceptance criteria implemented safely, or one behavior delivered at a time.
aidex-bugfix
Use when fixing a bug, resolving a reported issue, or when something is broken and needs a test-driven fix — investigate root cause, write a failing regression test (RED), implement the minimum fix, confirm the test passes (GREEN), then commit test and fix together. Fires on "fix this bug", "this is broken", "it's not…