Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KtKID/x-dev-pipeline --skill x-audit-archgit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-audit-arch)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-audit-arch"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-audit-arch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-audit-arch"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-audit-arch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00222 | $0.03236 |
| Opus 5 | $0.00111 | $0.01618 |
| Sonnet 5 | $0.00044 | $0.00647 |
| Haiku 4.5 | $0.00022 | $0.00324 |
Grade A, and why
x-audit-arch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x-audit-arch · 架构巡检
x-audit-arch 是独立巡检 skill，不在 x-dev → x-verify → x-qa-gate 主流程内。它由用户手动触发或大里程碑/重构后调用，做全项目视角的架构审查。
两条核心主线是用户最看重的：架构一致性（新代码守住项目既有的模块边界、分层、命名语义，而不是 AI 自己发明一套）和单一事实源（同一份关键信息只有一个权威来源，没有散落多处的重复定义）。其余维度（抽象合理性、契约、依赖健康）服务于这两条。
为什么独立
架构问题需要全局视角才有意义——单个文件本身没问题，但它把一个本该归属 A 模块的职责放进了 B 模块；单个 schema 定义没问题，但同一个枚举在三个地方各写了一份、已经开始漂移。这些都只有站在整个项目结构上看才暴露。塞进每个任务的 gate 会变成噪音，也看不到跨模块全貌，所以剥离成周期巡检。
与相邻 skill 的边界（避免重叠，必读）
| skill | 关注 | 与本 skill 的区别 |
|---|---|---|
| x-qa-gate R1 | spec 正确性：实现是否做了 spec 要的事 | R1 问"做对了吗"，本 skill 问"放对地方、符合项目结构吗"。功能正确但放错模块/破坏分层 → 归本 skill |
| x-audit-style | 表层规范：命名大小写、magic number、函数长度、死代码 | style 看局部、战术（这行代码风格）；arch 看结构、战略（这个职责该不该在这个模块）。命名只查语义归属（叫这个名字符不符合项目领域语义），大小写一致性归 style |
| x-audit-perf | 性能：复杂度、I/O、缓存 | 正交，互不重叠 |
最容易混的两处，按下面切：
- 重复代码：两段近乎一样的代码块 → x-audit-style「复用机会」（提取函数）；同一份事实源（枚举/默认值/schema/规则）在多处各定义一份 → 本 skill「单一事实源」（收敛到唯一权威来源）。前者是战术去重，后者是结构性漂移风险。
- 命名：snake/camel 大小写、缩写一致 → style；名字是否符合项目领域语义、有没有归属感（user/account/member 在本项目指同一概念却混用，导致读者误判模块边界）→ 本 skill。
流程
- 用户触发（手动调用 / 大里程碑 / 重构后）。
- dispatch 一个子 agent，prompt 包含本 SKILL.md 的检查清单 + 项目代码 + 输出格式。
- 子 agent 输出 audit-arch 报告。
- 写到
reports/audit/audit-arch-YYYYMMDD-HHmmss.md。 - 不自动触发 x-fix——由用户决定哪些问题进入 backlog。架构改动影响面大，必须人类裁决，不要让巡检直接动手改结构。
审查范围
- 用户指定模块、目录、分层时，按指定范围执行。
- 用户只说
x-audit-arch/架构巡检时，默认全项目视角（架构问题靠局部 diff 看不出来）。 - 范围太大时，先和用户确认聚焦哪几个模块/边界，避免泛泛而谈。
子 agent dispatch
Agent({
description: "Architecture audit",
subagent_type: "general-purpose",
prompt: <本 SKILL.md 的"检查清单"段 + 项目代码 + 输出格式>
})
报告顶部必须填写 Completed by model。
取证原则（架构判断也要有证据）
架构问题最容易写成空泛的"建议解耦""感觉过度设计"。本 skill 要求每个问题都落到可指认的证据，否则不进报告：
- 指出具体文件 / 符号 / 行号，说明它当前在哪、应该在哪。
- 单一事实源问题必须列出同一信息的所有副本位置（≥2 处），并说明是否已经漂移（值不一致 / 改了一处忘了另一处的痕迹）。
- 循环依赖、分层破坏必须给出依赖路径（A → B → A），而不是只说"耦合高"。
- 过度抽象必须回答："删掉这一层，谁会坏？"——答不出谁会坏，就是过度抽象的证据。
没有证据的纯架构洁癖、个人审美偏好不写进报告。
检查清单
1. 架构一致性 — 模块归属与分层（重点）
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 145 lines · 222 tokens per session scan A 0427169abc4d
x-audit-arch is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed today), licensed MIT. It adds 222 tokens to every session and 3,236 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
procoder
Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…
explain
Guided code tour of a file or subsystem this session touched — entry point, the load-bearing pieces, the edges, and what connects to it.
idea-team
A structured group discussion for exploring a product idea through three roles: researcher, critic, and analogy finder. The roles look for evidence, weaknesses, and useful comparisons.
codex-agent
Use when you want a second-opinion review via Codex CLI, cross-verification after another agent implements changes, debugging help, or alternative implementation proposals. Requires Codex CLI to be installed and authenticated.
project-health-auditor
Comprehensive codebase health analysis. Use when reviewing code quality, identifying technical debt, checking dependencies, or assessing project structure.
review-gate
Use before an agent-produced diff is committed, pushed, opened as a PR, merged, landed, or applied to user files when explicit implementation approval is missing. Trigger for review gate, review pack, approve before landing, diff first then land, human approval, merge gate, commit gate, push gate, or PR readiness.…