Borrowing it
Nothing to install: this file belongs to KonghaYao/peri. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/KonghaYao/peri/main/.claude/skills/project-maturity/SKILL.mdgit clone --depth 1 https://github.com/KonghaYao/periWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/konghayao/peri/project-maturity)<a href="https://agentmods.dev/skills/konghayao/peri/project-maturity"><img src="https://agentmods.dev/badge/skills/konghayao/peri/project-maturity/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/konghayao/peri/project-maturity"><img src="https://agentmods.dev/badge/skills/konghayao/peri/project-maturity.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 185 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 192 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.03752 |
| Opus 5.5 | $0.00042 | $0.01501 |
| Sonnet 5.5 | $0.00021 | $0.00750 |
| Haiku 4.5 | $0.00011 | $0.00375 |
Grade A, and why
project-maturity scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 429 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Maturity Scanner
对任意项目进行 8 维度深度成熟度扫描，产出结构化 Markdown 报告。
工作流概览
语言检测 → 加载 Reference → 并行收集 8 维度数据 → 综合评分 → 输出报告
三个核心原则：
- 用数据说话，不做主观猜测 — 每个评分背后都有可复现的命令和数据
- 先收集后评分 — 禁止在信息不全时下结论
- 风险优先 — 高风险项放在报告最前面，方便读者优先关注
Step 1: 语言检测与 Reference 加载
1.1 自动检测
扫描项目根目录，按优先级判断主语言：
| 信号 | 判定 |
|---|---|
Cargo.toml |
Rust |
package.json + tsconfig.json |
TypeScript |
package.json（无 tsconfig） |
JavaScript/Node |
go.mod |
Go |
pyproject.toml / setup.py / requirements.txt |
Python |
pom.xml / build.gradle |
Java/Kotlin |
Gemfile |
Ruby |
CMakeLists.txt |
C/C++ |
| 以上皆无 | Generic（通用检查） |
多语言项目：按代码量占比识别主语言和次语言，报告中对每种语言分别评估。
1.2 加载语言 Reference
根据检测结果，读对应 reference 文件获取语言特定的检查命令和指标：
references/rust.md— Rust 项目references/typescript.md— TypeScript/JavaScript 项目references/python.md— Python 项目references/go.md— Go 项目references/generic.md— 通用回退
Reference 文件包含的内容：
- 该语言的代码统计命令
- 测试框架识别与运行命令
- 静态分析/lint 工具
- 依赖审计工具
- 语言特定的成熟度阈值
Step 2: 并行收集 8 维度数据
关键：所有收集操作必须并行执行。不要串行逐个询问。
维度 1：项目规模
用语言 reference 提供的命令统计：
✅ 源代码行数（排除依赖/target/node_modules/build）
✅ 源文件数量
✅ 模块/包/crate 数量
✅ 各模块代码分布（最大的 5 个模块）
✅ 按语言拆分的代码量（多语言项目）
评价标准：
- 小型 < 5,000 行 | 中型 5k-50k | 大型 50k-200k | 超大型 > 200k
- 模块化程度 = 模块数量是否与代码规模匹配
维度 2：开发活跃度
✅ 总提交数 + 首次/最后提交日期
✅ 近 30 天提交趋势（每日统计）
✅ 贡献者数量 + Top 3 贡献者占比（识别总线因子）
✅ 活跃分支数 + 标签数
✅ 版本标签命名规范度
✅ 合并提交比例（反映协作模式）
评价标准：
- 近 30 天日均提交 > 3 → 极度活跃 | 1-3 → 健康 | 0.1-1 → 维护模式 | < 0.1 → 停滞
- 单人贡献占比 > 90% → 总线风险高
- 无版本标签 → 发布不规范
维度 3：测试覆盖
分两层检查：单元测试 + 集成/E2E 测试。
✅ #[test] / it() / def test_* 等测试函数数量
✅ 测试目录结构（tests/ 或 __tests__/ 等）
✅ 运行完整测试套件，统计通过/失败/跳过
✅ 各子模块的测试代码行数 vs 源代码行数
✅ 是否有 E2E/集成测试及框架
✅ 是否有覆盖率工具配置（tarpaulin/istanbul/coverage.py 等）
✅ CI 中是否跑测试
评价标准（通用）：
- 测试/源代码比 > 50% → 优秀 | 20-50% → 良好 | 5-20% → 不足 | < 5% → 严重不足
- 核心模块零测试 → 直接标红
- CI 不跑测试 → 扣一档
注意：不同语言/框架的测试文化不同。Rust 项目 5% 测试比可能已经不错（大量类型系统保证），但 JS/Python 项目 5% 是严重不足。具体阈值见各语言 reference。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed 9268cf12906b
- 1mo ago First seen · 429 lines · 105 tokens per session scan A d492c25ff4ad
project-maturity is a skill published in the GitHub repository KonghaYao/peri (247 stars, last pushed today), licensed Apache-2.0. It adds 105 tokens to every session and 3,752 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
plugin-creator
Create and scaffold plugin directories for Codex with a required .codex-plugin/plugin.json, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries…
codex-pr-body
Update the title and body of one or more pull requests.
remote-tests
Testing against remote executors in integration tests.
update-v8-version
Update Codex's pinned v8 / rustyv8 versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update rustyv8 artifacts, prepare or validate a V8 release candidate, check v8-canary, or diagnose why a V8 version update no longer builds.
qa-testing
Verify your work by actually operating the app or website you changed, instead of assuming it works. Strongly recommended whenever you build, modify, or debug a web app, website, or desktop GUI app. Drive real browsers with the agent-browser CLI and native desktop apps with the cua-driver CLI. These are installed on…