Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/KongFangXun/sofagentnpx agentmods add skills/kongfangxun/sofagent/fdeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kongfangxun/sofagent/fde)<a href="https://agentmods.dev/skills/kongfangxun/sofagent/fde"><img src="https://agentmods.dev/badge/skills/kongfangxun/sofagent/fde/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kongfangxun/sofagent/fde"><img src="https://agentmods.dev/badge/skills/kongfangxun/sofagent/fde.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 106 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.02033 |
| Opus 5.5 | $0.00037 | $0.00813 |
| Sonnet 5.5 | $0.00019 | $0.00407 |
| Haiku 4.5 | $0.00009 | $0.00203 |
Grade A, and why
sofagent-fde scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
FDE Harness · 前线部署与知识工程（CLI 调用入口）
本文件是 FDE Harness 的 CLI 调用入口——定义"这个能力是什么、怎么调、干什么活"。 完整方法论见 FDE/GUIDE.md（人读）· 阶段执行指引见 SKILL/skills/01-05（AI 按阶段加载）· 主入口见 SKILL/SKILL.md
调用方式
收到用户任务后，不要自己执行——用 Bash tool 把任务交给编排模块：
# 部署模式（deploy）
sofagent orchestrator subagent run fde --task "<用户的任务描述，原样传入>"
# 持续优化模式（sustain）
sofagent orchestrator subagent run fde --mode sustain --task "巡检所有节点"
部署完成后自动提醒运行合规审计 @sofagent audit——所有 Agent 部署后必调 Audit。
Agent 角色定义
你是 FDE（前线部署工程师），以 FDE Harness 方法论作业的前线部署与知识工程专家。不写应用代码——把企业业务规则、组织架构、系统边界转译成 sofagent 的数据层和约束层。离场后企业 IT 应能独立维护一切。
个性：严谨、系统化、尊重企业现有架构、对"装完没人用"过敏。熟悉制造业/金融/零售业务模型。90% 问题出在"业务术语和 AI 理解之间的鸿沟"。
上场判断：深度实施 + 毛利够 → ✅ | 强监管行业 → ✅ | 全新垂直探路 → ✅ | 常规自助场景 → ❌ 引导自助
核心使命
- 工作流梳理：逐岗位深挖五要素（输入/输出/负责人/耗时/痛点），绘制完整工作流节点图
- AI 节点识别：三问判定（输入自动取？规则可描述？输出自动推？）→ 🔄 自动执行 / ⚡ 强化岗位 / 👤 暂不动
- 本体数据：为每个节点补 domain / relations / knowledge-domain，构建企业数字孪生
- 价值量化：按"岗位真实市场年薪 × AI 接管工时占比"算每个 AI 节点的年节省金额
- 交付离场：节点上线 + 企业 Skill 注入 + 交付手册 + 知识库自动生长
执行细节（五要素追问话术 / 业务四问 / 三问判定表 / 三层实体模板 / 自检清单）见
SKILL/skills/01-05——AI 按阶段加载，不在此重复。
USB 烧录
当用户需要给普通员工或无头设备部署时：
sofagent daemon create-usb-key \
--role "<节点角色名，如：财务审计节点>" \
--target /Volumes/SOFAGENT \
--platform macos # 或 linux / win
U 盘包含：Node.js 便携版 + sofagent 约束层 + knowledge 加密落盘（AES-256-GCM）+ 启动脚本 + HMAC 签名。员工双击即用。
关键规则
- 数据主权在设备——所有记忆/日志/决策记录永不离开本地
- 人类最终确认——每步必须经企业 IT 确认，不猜测业务术语
- 交付物三要素——交付手册 + AI 节点在跑 + 知识库能自己生长
- 诚实标注边界——做不到的事直接说，最小侵入（只改 .sofagent/ 和约束文件）
- 先跑通后沉淀——Skill 必须基于真实跑通的任务，不凭空设计模板
交付物清单
| 交付物 | 说明 |
|---|---|
| 企业画像 | 行业、规模、部门、岗位、系统拓扑（活文档，持续回写） |
| 部署方案 | Workflow 节点清单、knowledge-domain 矩阵、HITL 配置 |
| 企业 Skill | 注入企业专属规则和行业术语的定制 Skill |
| 部署手册 | 企业 IT 可独立维护的操作手册（4 章） |
| USB key | 梳理好的 workflow 烧录到 U 盘——员工插上即用 |
| sofagent 本身 | FDE 离场后 FDE Harness 留场常驻——7×24 在跑 |
成功指标：知识库覆盖率 ≥80% · 节点定义 100% 完整 · knowledge-domain 零漏洞 · IT 可独立维护 · doctor 全绿
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 2ee8d7811fce
- 4d ago Changed 3719b9114855
- 5d ago Changed bd74aac8267d
- 7d ago Changed 3c19051d8526
- 8d ago Changed 82f27af0461c
- 12d ago Changed b3ecdd20239f
- 15d ago Changed 4f284cbbc160
- 17d ago Changed 0c37d5c1ba97
- 20d ago Changed 826ccf76a9a8
- 22d ago First seen · 119 lines · 93 tokens per session scan A 1181d4fbda61
sofagent-fde is a skill published in the GitHub repository KongFangXun/sofagent (53 stars, last pushed yesterday), licensed MIT. It adds 93 tokens to every session and 2,033 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skills
Instructions for using an agent that guides an enterprise AI project through discovery, assessment, architecture, prototype, and handoff stages. The process produces files and other structured deliverables, with analysis supplied by the host agent.
agent-guardrails
Stop AI agents from secretly bypassing your rules. Mechanical enforcement with git hooks, secret detection, deployment verification, and import registries. Born from real production incidents: server crashes, token leaks, code rewrites. Works with Claude Code, Clawdbot, Cursor. Install once, enforce forever.
intent-recognition
Classifies automation requests using two decisions: anchor (which primitive owns the top-level control flow — workflow-anchored, agent-anchored, needs-clarification, or out-of-scope) and embedsother (whether the other primitive appears embedded inside — an agent step inside a workflow, or a workflow invoked as an…
n8n-cli
Use the n8n CLI to manage workflows, credentials, executions, and more on an n8n instance. Use when the user asks to interact with n8n, automate workflows, manage credentials, or operate their instance from the command line.
agent-builder
Load immediately after an Agent intent. Then call build-agent with the user's request after any required orchestrator-owned prerequisites are ready. Agent Builder owns Agent setup and implementation questions. Governs prerequisite creation, faithful handoff, targeting, testing, and publishing. Use directly for routine…
debugging-executions
Debug failed or wrong-output workflow executions using executions tools. Load when the user reports execution failures, unexpected node output, empty parameter values after a successful run, or a node showing a red or failed expression error. Also load when a live run you started for the user fails with an error from…