Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ktkid/x-dev-pipeline/x-reqnpx skills add KtKID/x-dev-pipeline --skill x-reqgit clone --depth 1 https://github.com/KtKID/x-dev-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-req)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-req"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-req.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00092 | $0.00841 |
| Opus 5 | $0.00046 | $0.00420 |
| Sonnet 5 | $0.00018 | $0.00168 |
| Haiku 4.5 | $0.00009 | $0.00084 |
Grade A, and why
x-req scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
x-req — 风险路由规划
产物
新 task 需要 README.md 与 dev-checklist.md；涉及至少三个模块或用户要求图时加入 diagram.md。README 的 risk: Q0|Q1|Q2|Q3 是风险唯一真源，验收 Requirement/Scenario 是 DoD 真源，dev-report 保存 verify 证据。
定级
| 等级 | 判据 | 流程 |
|---|---|---|
| Q0 | 单文件且没有行为分支变化 | lite task → x-dev → verify → 交付 |
| Q1 | 局部功能或修复，没有跨模块契约变化 | lite task → x-dev → verify → 交付 |
| Q2 | 新功能、多文件、契约或状态变化 | 一次确认 → x-dev → verify → RC |
| Q3 | 鉴权、权限、加密、不可逆写入或迁移、公开 API/协议/schema、并发、状态机、缓存一致性 | 一次确认 → x-dev → verify → R1→R2→R3 |
用户显式定级优先。Q0/Q1 直接编写 task 并在完成汇报中说明定级依据；用户可随时指定“按 Q2 走”。架构归属、状态模型或跨模块边界未闭合时转 x-spec。
流程
- 定位 task：新建使用
dev-pipeline/tasks/<name>/；更新先读现有 README、checklist 与 dev-report，保留无关内容并写updated: YYYY-MM-DD <summary>。 - 调查用户请求、关联 spec、模块文档和代码入口，确定需求、边界类、公开契约、数据流、失败路径、验收场景和 risk。
- Q2/Q3 依据
templates/confirmation.md一次展示确认；用户修改后更新并再次确认；取消则结束。 - 确认或 Q0/Q1 直通后，运行
python3 tools/xdev.py scaffold <task-dir>；涉及图时加--with-diagram。 - 依次运行
instructions readme、instructions dev-checklist、按需instructions diagram；填写模板，删除 HTML 注释。 - README 写入 risk；每个验收 Scenario 有 WHEN、THEN、
验证: auto|manual；自动场景由后续 dev-report verify 块回指。 - 运行
python3 tools/xdev.py validate <task-dir>，修复 issue 直到零 issue；检查需求覆盖、验收可判定性、架构归属和 checklist 追溯。 - 输出 task 路径、产物、risk 依据、validate 结论和下一步
x-dev <task-name>。
内容规则
- Q0/Q1 保留核心目标与验收；Q2/Q3 还写需求要点、涉及模块、架构拆分策略和技术设计。
- checklist 使用
# | 任务 | 涉及文件 | 依赖 | 状态 | fix表头与 token+emoji 状态。 - diagram 是 README 模块与边界的投影，节点名称保持双向一致。
- 历史 task 保持原状；活跃 task 使用本契约。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 42 lines · 92 tokens per session scan A 9036d15732a1
x-req is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 1mo ago), licensed MIT. It adds 92 tokens to every session and 841 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
work
Execute Elixir/Phoenix plan tasks with progress tracking. Use after /phx:plan to implement features with mix compile and mix test verification after each step, or --continue to resume interrupted work.
plan
Plan features spanning multiple domains: billing (Stripe), auth (RBAC), real-time (Presence), webhooks, jobs (Oban). Use when designing interconnected systems or converting review findings into tasks.
phx-deps-update
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).
procoder
Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…
plan-creation
Create structured implementation plans via a 4-role scrum team (Product Owner, Architect, Eng/Delivery Lead, QA/Critic) with optional Agent Teams peer debate mode.
sprint-plan
Start the Plan phase of the SPARK loop: the Engineering Manager turns an approved spec into a technical plan — architecture decision with rejected alternatives, ordered task breakdown with definitions of done, test strategy and risks. Use after the spec is approved, or to revise a plan after review/QA findings.