Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kanocifer/devtaskmcp/devtask-reviewnpx skills add KanoCifer/DevTaskMcp --skill devtask-reviewgit clone --depth 1 https://github.com/KanoCifer/DevTaskMcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00049 | $0.00941 |
| Opus 5 | $0.00024 | $0.00470 |
| Sonnet 5 | $0.00010 | $0.00188 |
| Haiku 4.5 | $0.00005 | $0.00094 |
Grade A, and why
devtask-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
devtask-review
把任务从“自称完成”变成可被证成的完成：先验收，再做轻量清理审查，最后报告剩余问题。
遵循 ../references/task-contract.md；验收需要正文时使用 get_task(slug, view="full")，子任务用 list_children 获取摘要，必要时再按需读取 full。
流程
1. 拉取任务
get_task(slug, view="full")
kind == "spec" → list_children(parent_slug=slug) 获取 summary 列表。
不要一次性拉所有 child 的 full 视图；只对需要审的 child 单独 get_task(child, view="full")。
blocked_by 非空 → 检查 blocker 状态：未完成则建议先执行 blocker，不继续往下审。
2. 验收条件验证（只读）
解析 ## Acceptance Criteria 章节。空则记录“无可验证内容”，但继续后续视角。
分类验证方式：
- 代码检查 — Read / grep 确认模式存在
- 运行时 — 发请求 / 执行命令，断言输出
- 子任务完成（parent 特有）— 子任务各自 AC 全部 ✅ 则本条 ✅
每条记录 ✅ / ❌ / ❓ 并附证据（file:line、命令输出、diff 片段）。歧义 → ❓ 不猜。
3. 四视角清理审查（并行）
按 ## Context Pointers 章节里的 path:line 找到被改动的代码。改动范围不明时跳过本节并在报告里注明。
按 references/review-perspectives.md 并行运行四个视角；小改动合并为单 Agent。每个 finding 必须带 file:line、摘要、代价和具体修法。
4. 正确性 + 安全审查
单 Agent 扫：
- 边界条件 / 错误路径 / 资源泄漏
- 注入 / 鉴权 / 敏感信息泄露
- 并发 / 竞态
只报不修（正确性/安全修改须经用户确认）。
5. 应用清理修复
等四视角全部回来后：
- 去重 — 多视角指向同一机制只改一次
- 逐条真改 — 按 finding 的修法落地
- 显式 skip — 以下情况不修，记录 skip + 一句话 reason：
- 修法会改变意图或 AC 已定义的行为
- 越出本次改动范围的大范围重构
- 误报（判断后）
正确性/安全类 finding 永远不自动修，只在报告里给建议。
需要固化决策时用 update_task(slug, detail=...) 更新 Decisions；不要只写本地文件。
6. 状态修正
parent：子任务 AC 全部 ✅ + 自身 AC 全部 ✅ → update_task(slugs=[...]) 批量翻到已完成。
7. 报告
按 references/report-template.md 格式输出。全 AC 通过 + 清理全 clean → 末尾一句话总结"可以被证成完成"；否则明确 remaining work。
Rules
- 正确性/安全永不自动改 — 单列报告，由用户决策
- 范围不明时跳过清理 — 不要猜 diff
- 显式 skip — 每个不修的 finding 都写一句原因
- Parent 递归 — 子任务和自身 AC 全通过才完成 parent
- 按需读 full — 验收和执行需要正文时再读 full
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 84 lines · 49 tokens per session scan A 39b0fca0e173
devtask-review is a skill published in the GitHub repository KanoCifer/DevTaskMcp (0 stars, last pushed 7d ago), licensed MIT. It adds 49 tokens to every session and 941 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…