Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-qualitygit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-quality)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-quality"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-quality/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-quality"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-quality.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 28 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 28 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03947 |
| Opus 5 | $0.00000 | $0.01973 |
| Sonnet 5 | $0.00000 | $0.00789 |
| Haiku 4.5 | $0.00000 | $0.00395 |
Grade A, and why
pdlc-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
质量闸门与报告
跑真实 check → 对照质量目标 → 出可核对的报告 → 人签字放行。
这个命令的立身之本
一切判定来自客观数据：覆盖率数字来自覆盖率工具、E2E 覆盖来自 flow→test 映射 + 真跑结果、lint 来自退出码。 AI 只负责把这些数据整理成报告，不参与"达标与否"的判定，放行由人。
⛔ 绝不允许出现的行为：用"我看了一下代码，测试挺全的"这类判断替代真实数据； 用上一次的结果冒充本次；命令没跑通却按通过处理；覆盖率没测量却写一个数字。 量不到就如实写"未测量"——这与状态机里「无命令可跑 →
checks: {}」是同一条纪律。
前置：两份真源
| 文件 | 作用 | 缺失时 |
|---|---|---|
docs/00_standards/test-commands.yml |
怎么量（命令） | 中止，提示先跑 /pdlc-test-setup |
docs/00_standards/quality-targets.yml |
量到多少算达标 | 走 --init 交互创建（见下） |
docs/00_standards/e2e-flow-map.yml |
核心流 → E2E 测试 的映射 | 若 targets 里声明了 core_flows 则必须有，否则 E2E 判定无法机械化 |
--init：首次建立目标声明
- 读
templates/quality-targets-template.yml作骨架。 - 从 PRD 自动抽
core_flows草稿：扫docs/01_requirements/prd/，提取标记为 P0 / P1 的功能流程， 生成候选清单（含来源 PRD 路径）供人确认——降低首次声明的摩擦，但最终清单必须人确认，不自动落盘。 - 覆盖率达标线：默认与
test-commands.yml的 coverage 命令参数对齐；两者不一致要提示人对齐 （以命令参数为准——那才是真正的强制点）。 - 同时生成
e2e-flow-map.yml骨架（每条 flow 一个空tests列表待填）。
段一：跑真实 check
按 test-commands.yml 逐条真跑 coverage / e2e / lint，记录命令原文 + 退出码 + 关键输出。
退出码的三态语义、以及「命令跑不了 = yml 过期信号」按下面的规则处理：
补充两条本命令特有的：
- 命令为空字符串（项目未配置该项）→ 如实记为「留空，未测量」，不得因此判为通过
- 覆盖率数字从工具输出中摘取原文，不重新计算、不四舍五入到好看的数
段二：三项机械核对
2.1 覆盖率
拿实测数字对 quality-targets.yml 的达标线。真正的强制点是命令参数里的阈值（如 --cov-fail-under=85）——
退出码就是判定；yml 里的数字用于报告展示与趋势。两处不一致 → 报告里提示对齐。
2.2 E2E 覆盖矩阵（B2 的第一个地基）
对每条 core_flow，按 e2e-flow-map.yml 找到映射的测试标识，再到本次真跑的 E2E 结果里核对：
| 情况 | 判定 |
|---|---|
| 映射存在 且 对应测试本次通过 | ✅ |
| 映射存在 但 测试本次失败 | ❌ |
| 映射存在 但 该测试在本次结果里找不到 | ❌ 映射腐烂（指向了不存在的测试） |
core_flow 在映射文件里没有条目 |
❌ 缺映射 |
映射里有 core_flows 中不存在的 id |
⚠️ 黄：孤儿映射，建议清理 |
缺一条 = 红。 绝不用"我觉得这条流程被别的测试覆盖了"来补空缺——那正是要消灭的主观判断。
2.3 配置健康度（顺带检测，零额外成本）
段一已经把每条命令真跑了一遍，过期信号是白捡的。汇总成报告的一节：
| 状态 | 判据 | 报告里怎么写 |
|---|---|---|
| ✅ 健康 | 命令跑起来了（退出码 0 或非 0 皆可） | 正常 |
| ⚠️ 已失效 | 127 / command not found / 脚本不存在 |
「<项> 的命令已跑不通——yml 过期」+ 报错原文 |
| 💡 可收紧 | 该项当前留空，但本次探测到已可用的命令 | 「<项> 现在可以填了：<候选命令>（已验证退出码 <N>）」 |
| — 留空 | 该项留空且确无可用命令 | 「留空，未测量」（不得判为通过） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 217 lines · 0 tokens per session scan A aadc77924f1c
pdlc-quality is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,947 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
integration
Run integration and e2e tests after unit tests pass. Use after /supergraph:fix when unit tests are green.
xcode-testing-workflow
Guide Swift Testing, XCTest, XCUITest, XCUIAutomation-oriented mechanics, code coverage, xctestplan matrices, accessibility-verification follow-through, test filtering, retries, diagnostics, and test-specific fallback work in existing Xcode-managed projects and workspaces. Use when Xcode-aware execution is needed and…
aidex-coverage
Use when writing, placing, or running tests in any project — which layer a behaviour belongs in ("unit or E2E for X", "component test or browser test"), which tests to run for a change instead of the whole suite, when to extract a fixture, setting up an isolated disposable E2E environment, or the per-project testing…
ios-testing
Invoke any time a user is writing iOS/Swift tests or asking why tests behave a certain way — including XCTest versus Swift Testing (@Test/#expect) choices, async ViewModel tests with @Observable or @Published, snapshot testing across device sizes, mocking protocols for dependency injection, setUp/tearDown lifecycle…
e2e-test-matrix
Design end-to-end coverage across critical paths. Use for release readiness, user workflows, UI/API flows, and adapter validation.