Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-shipgit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-ship)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-ship"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-ship"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 4 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 64 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Prompt Injection · line 22 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 22 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02527 |
| Opus 5 | $0.00000 | $0.01264 |
| Sonnet 5 | $0.00000 | $0.00505 |
| Haiku 4.5 | $0.00000 | $0.00253 |
Grade A, and why
pdlc-ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
发布工作流
串联发布一个版本所需的所有步骤:跑测试 → 升级 VERSION → 更新 CHANGELOG → 创建 tag → 推送触发 CI/CD。
⛔ 发布是破坏性·不可逆操作:打 tag / bump 版本 / 触发 CI/CD 属破坏性范畴。
--autonomous对本命令无效——即使带该参数,§1.1(未完成功能)与 §1.2(测试门)的人工确认仍必须真实由人应答。自主循环(/pdlc-loop-run)的终态是review_done,永不进入本命令。
段一:执行
1.1 前置检查
-
确认当前分支不是
master/main(参考 CLAUDE.md §5) -
确认工作区干净(
git statusclean) -
检查
docs/.pdlc-state/下是否有未完成的功能(current_stage不在[*_done]的)- 有 → 列出来并询问是否继续(用户明确同意才继续)
- 无 → 直接进入下一步
-
质量闸门检查(若项目有
docs/00_standards/quality-targets.yml): 读docs/07_reviews/quality/下最近一份.md报告(同名.html只是视图, 闸门一律以.md为准——两者若不一致,信.md):- 无任何报告 → 提示先跑
/pdlc-quality,询问是继续还是先出报告 - 报告总判定未达标 → 默认不放行;要发必须由人显式 override 并写明理由, 该理由需记入本次发布的 CHANGELOG 或发布说明(不允许无声跳过)
- 报告过期——分两档处理,不是所有过期都等价(见下)
- 达标且未过期 → 在发布报告里引用该报告路径、日期与 commit SHA 作为质量证据
过期判定:按「改动了什么」分两档
报告头部记着生成时的
<!-- 仓库版本: <commit SHA> -->(由/pdlc-quality落盘时写入)。 取该 SHA,跑git diff --name-only <SHA>..HEAD看这期间动了什么:这期间改动命中 判定 理由 docs/01_requirements/prd/、docs/00_standards/quality-targets.yml、docs/00_standards/e2e-flow-map.yml、docs/00_standards/test-commands.yml硬闸·不放行 报告里的 PRD ↔ core_flows对账与 E2E 覆盖矩阵的输入变了,结论不再成立。重跑单测补不回对账——必须重跑/pdlc-quality只有其它代码 / 文档 提示已过期,建议重跑 对账仍成立,测量数字可能略旧 报告里没有 仓库版本字段,或该 SHA 在本仓库解析不了按「不可判」处理:明确告知无法核对新鲜度,建议重跑 与三态语义同一条纪律——「查不了」不等于「没问题」,不得静默当作未过期 ⛔ 硬闸同样允许人显式 override 并写明理由(与「总判定未达标」同一条通道,理由须记入 CHANGELOG 或发布说明),但不得无声跳过。
quality-targets.yml变动要单独看一眼「闸门是不是被调松了」若上表命中的文件里包含
quality-targets.yml,除了要求重跑,还必须把git diff <SHA>..HEAD -- docs/00_standards/quality-targets.yml原样展示给人, 并逐条点出下列「变松」信号——命中任何一条都要人明确确认,不得只当作普通过期:- 覆盖率目标数字下降(如 85 → 70)
core_flows条目减少(核心流被移出闸门视野)- lint 策略放宽(如 zero-warnings 改为允许若干 warning)
- 新增了豁免声明(把某些 PRD / 流程排除在对账之外)
- 无任何报告 → 提示先跑
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +29 lines 1611802a7f98
- 11d ago First seen · 159 lines · 0 tokens per session scan A b47e683eceba
pdlc-ship is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,527 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
update-downstream-packages
Use when rolling a newly published package release through every maintained consumer repository and verifying CI.
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.
swarm-migrate
Cross-repo migration swarm — one coordinator + N parallel subagents (one per target repo) that apply the same transformation, open PRs, wait for CI, and report back to a shared JSON ledger. Coordinator handles topology, conflict auto-rebase, and stop-on-novel-failure. Use when bumping a shared dependency, rolling out…
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary. The complete landing pipeline.
github-release-management
Comprehensive GitHub release orchestration with AI swarm coordination for automated versioning, testing, deployment, and rollback management.
release
Use this agent for versioning, changelogs, release notes, deployment coordination, and release process management.