Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KtKID/x-dev-pipeline --skill x-crgit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-cr)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-cr"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-cr.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00183 | $0.02283 |
| Opus 5 | $0.00092 | $0.01141 |
| Sonnet 5 | $0.00037 | $0.00457 |
| Haiku 4.5 | $0.00018 | $0.00228 |
Grade A, and why
x-cr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x-cr · 软件正确性调查
x-cr 是通用的软件正确性调查入口。它合并两种常见场景：
- 用户已知问题：用户说某个行为不对、某个 bug 复现、某条链路异常，需要查根因。
- 模块正确性 review：用户让 review 某个模块、文件、diff 或 PR，需要主动寻找可能导致错误结果的真实风险。
两种场景共用同一条主线：现象/契约 -> 候选原因 -> 贝叶斯证据更新 -> 根因分类 -> spec 对照 -> CR 报告。
对抗性检验在 x-cr 中是正确性取证方法：主动构造能击穿当前实现或判断的输入、状态、依赖失败、权限、缓存、并发、测试过拟合场景，再用代码路径、spec、测试、日志或 diff 证据确认、降级或排除。
命名、格式、纯风格偏好归属 x-audit-style；架构一致性、单一事实源、过度抽象、分层/依赖等结构性问题归属 x-audit-arch。x-cr 聚焦“软件是否按预期正确工作”。
必读参考
执行 x-cr 时加载：
references/bayesian-review.md：贝叶斯根因调查方法。references/checklist-general.md：正确性检查清单。references/report-template.md：CR 报告格式。
语言知识只用于判断运行时错误、类型逃逸、异步错误、资源泄漏、并发和数据边界。风格清单和命名规范退出 x-cr 调查。
输入模式
模式 A：用户已知问题
触发例子：
- “这个登录状态不太对，帮我查原因”
- “这里结果和预期不一致”
- “这个 bug 是配置读取导致的吗”
- “刷新 token 后还是失败，继续查”
目标：
- 明确实际现象、期望行为和复现证据。
- 用贝叶斯更新逐步降低错误假设，提高真实根因置信度。
- 对照原始 spec，判断根因类别。
模式 B：模块正确性 review
触发例子：
- “review 一下这个模块有没有正确性问题”
- “看一下这个 PR 有没有会导致结果错的地方”
- “检查当前 diff 是否会偏离原始需求”
目标：
- 先找模块契约、入口、状态流、关键用户路径和原始 spec。
- 主动提出会导致错误结果的候选假设。
- 只报告有证据支撑的正确性风险。
审查范围
- 用户指定文件、目录、diff、PR 或模块时，按指定范围执行。
- 用户只说
x-cr/review/检查一下时，使用当前 git diff。 - 当前 git diff 为空且用户未指定范围时，请用户给出模块、文件、PR 或现象。
报告路径：
- 在 task 目录中执行：
dev-pipeline/tasks/<task>/reports/cr/cr-report-YYYYMMDD-HHmmss.md - 在普通仓库范围执行：
reports/cr/cr-report-YYYYMMDD-HHmmss.md
执行流程
1. 建立调查对象
先写清楚本次调查对象：
| 字段 | 内容 |
|---|---|
| 模式 | 已知问题 / 模块正确性 review |
| 用户现象 | 用户看到的错误、异常或疑点 |
| 期望行为 | 用户预期、产品预期或 spec 预期 |
| 实际行为 | 日志、测试、代码路径或用户描述中的实际行为 |
| 审查范围 | 文件、目录、diff、PR、模块 |
模式 A 中，用户现象是第一证据。模式 B 中，模块契约和入口行为是第一证据。
2. 定位原始 spec
按优先级查找原始 spec：
- 用户当前消息中的期望行为和约束。
- task
README.md、dev-checklist.md、plan.md、dev-report.md。 - PR 描述、issue、产品文档、模块 README。
- 测试用例中的契约断言。
- 既有调用方行为和公开 API 文档。
记录 spec 来源和证据路径。缺少 spec 时，将根因分类中的 spec 缺口 作为候选项。
3. 建立候选根因
列出 3-6 个候选原因 H，覆盖这些方向：
| 根因类型 | 例子 |
|---|---|
| H_spec_mismatch | 原始 spec 要 A，当前实现做了 B |
| H_impl_drift | spec 清楚，开发实现过程中漏做、做偏、回归 |
| H_state_boundary | 状态、输入、错误路径、并发边界导致异常 |
| H_config_data | 配置、环境变量、数据形状、迁移状态导致异常 |
| H_test_gap | 测试未覆盖关键契约，错误进入代码 |
| H_spec_gap | 原始 spec 缺少关键约束或存在歧义 |
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 185 lines · 183 tokens per session scan A 5d9c8d25348f
x-cr is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 1mo ago), licensed MIT. It adds 183 tokens to every session and 2,283 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codebase-audit
A read-only method for auditing an entire codebase across contracts, data integrity, errors, security, architecture, technical debt, configuration, and caching. It produces prioritized findings and a repair roadmap.
codex-agent
Use when you want a second-opinion review via Codex CLI, cross-verification after another agent implements changes, debugging help, or alternative implementation proposals. Requires Codex CLI to be installed and authenticated.
project-health-auditor
Comprehensive codebase health analysis. Use when reviewing code quality, identifying technical debt, checking dependencies, or assessing project structure.
procoder
Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…
rubber-ducky
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke holes in this", "what am…
code-hygiene
Codebase health analysis: dead code, test quality, duplicates, complexity, security, architecture mapping. Tool-first, structured storage, forge integration.