Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-test-setupgit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-test-setup)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-test-setup"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-test-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-test-setup"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-test-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 65 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03355 |
| Opus 5 | $0.00000 | $0.01677 |
| Sonnet 5 | $0.00000 | $0.00671 |
| Haiku 4.5 | $0.00000 | $0.00335 |
Grade A, and why
pdlc-test-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.
立测试地基
给项目一键立起「客观 check」的地基：探测技术栈 → 逐条验证命令真能跑 → 写 docs/00_standards/test-commands.yml → 脚手架测试目录 → 接本地钩子。
为什么需要它
pdlc 的命门是「checks 只认命令退出码，绝不用模型自评」——pdlc-tdd / pdlc-implement / pdlc-review
与外层循环全都从 docs/00_standards/test-commands.yml 取命令。但在此之前没有任何东西帮你把这个文件立起来，
没有它，整条客观化链路就是空的。本命令把这块地基变成 turnkey。
⛔ 本命令最重要的一条纪律：写进
test-commands.yml的每条命令，必须先被真跑过一次、亲眼看到退出码。 一条"看起来对但跑不了"的命令比留空更坏——它会让下游每个阶段都拿到假的checks， 而整个 pdlc 的可信度正建立在这些 checks 是真的之上。猜出来的命令一律不写。
--refresh：让这份 yml 跟上项目的演进
项目会漂移——脚本改名、runner 换代、工具从依赖里移除、子项目增删。这份 yml 一旦过期，
下游所有 checks 就开始失真。--refresh 是重新探测 + 给出 diff，而不是从头再来：
- 逐条复跑现有命令，按
check-commands.md的三态判定谁还活着（跑不通 ≠ 检查没过）。 - 重新探测候选，与现状对比，得出变更清单。
- 按方向决定自不自动（这条是安全底线）：
- 不管自动与否，全部变更都要在报告里列出：改了什么、为什么、依据是哪次真跑的退出码。
自动应用的也要能一眼看出来，便于事后
git diff复核。
⚠️ 最危险的"自动修复"是把坏掉的 check 留空——闸门瞬间松了，报告还是绿的。 所以留空 / 删除 / 降阈值 / 替换一律走人工确认，
--autonomous也不豁免。替换也算，哪怕换上去的命令能跑、看起来更严：原命令的规则往往已不可考，没法证明新命令与它等价—— 新命令可能在这一维更严、在另一维更松。方向不可判，就不能当作变严自动应用（与三态「查不了 ≠ 没问题」 同一条纪律）。能自动应用的只有一种：原来留空的项，这次探测到命令并真跑验证通过——那是从「没测」到 「测了」，方向确定。
从哪来的过期信号：不用你盯着——pdlc-tdd / pdlc-implement / pdlc-review 每次跑 check
时遇到"命令跑不了"都会提示，/pdlc-quality 的报告里还有专门的「配置健康度」一节。
看到提示再来 --refresh 即可。
段一：探测与验证
1.1 技术栈探测
扫描特征文件，识别语言 / 包管理器 / 测试框架：
| 特征文件 | 栈 | 典型 unit | 典型 coverage | 典型 lint |
|---|---|---|---|---|
Cargo.toml |
Rust | cargo test |
cargo llvm-cov --fail-under-lines <阈值> |
cargo clippy -- -D warnings |
package.json |
Node | pnpm test / npm test |
vitest run --coverage.thresholds.lines=<阈值> |
npx eslint . |
pyproject.toml / requirements.txt |
Python | pytest |
pytest --cov --cov-fail-under=<阈值> |
ruff check . |
go.mod |
Go | go test ./... |
go test ./... -cover |
golangci-lint run |
pom.xml / build.gradle |
JVM | mvn test / ./gradlew test |
jacoco check | mvn checkstyle:check |
仅 *.sh |
Shell | 项目自有测试脚本 | —（通常无） | shellcheck <文件> |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +7 lines 7c77079ffeef
- 12d ago First seen · 188 lines · 0 tokens per session scan A 487bbffcc976
pdlc-test-setup is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,355 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
postgres-database-migration
Use this skill for planning, testing, and safely executing PostgreSQL schema migrations — especially when working with production data or shared databases. Trigger when user asks to: Test a schema migration before applying it to production Add, remove, or rename columns safely on a live table Change a column's data…
setup-timescaledb-hypertables
Use this skill when creating database schemas or tables for Timescale, TimescaleDB, TigerData, or Tiger Cloud, especially for time-series, IoT, metrics, events, or log data. Use this to improve the performance of any insert-heavy table. Trigger when user asks to: Create or design SQL schemas/tables AND…
design-postgis-tables
Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications.
migrate-postgres-tables-to-hypertables
Use this skill to migrate identified PostgreSQL tables to Timescale/TimescaleDB hypertables with optimal configuration and validation. Trigger when user asks to: Migrate or convert PostgreSQL tables to hypertables Execute hypertable migration with minimal downtime Plan blue-green migration for large tables Validate…
pgvector-semantic-search
Use this skill for setting up vector similarity search with pgvector for AI/ML embeddings, RAG applications, or semantic search. Trigger when user asks to: Store or search vector embeddings in PostgreSQL Set up semantic search, similarity search, or nearest neighbor search Create HNSW or IVFFlat indexes for vectors…
find-hypertable-candidates
Use this skill to analyze an existing PostgreSQL database and identify which tables should be converted to Timescale/TimescaleDB hypertables. Trigger when user asks to: Analyze database tables for hypertable conversion potential Identify time-series or event tables in an existing schema Evaluate if a table would…