Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lync-cyber/CataForge --skill change-guardgit clone --depth 1 https://github.com/lync-cyber/CataForgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lync-cyber/cataforge/change-guard)<a href="https://agentmods.dev/skills/lync-cyber/cataforge/change-guard"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/change-guard.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01553 |
| Opus 5 | $0.00014 | $0.00776 |
| Sonnet 5 | $0.00006 | $0.00311 |
| Haiku 4.5 | $0.00003 | $0.00155 |
Grade A, and why
change-guard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
变更守卫 (change-guard)
能力边界
- 能做: 分析变更请求与已有文档的覆盖度、分类变更类型、评估影响范围、输出路由指令
- 不做: 修改文档或代码(仅分析和分类)、替代reviewer的审查职能
输入规范
- 用户变更描述 (自然语言)
- 当前项目已有文档 (通过context检索: PRD, ARCH, UI-SPEC, DEV-PLAN)
输出规范
<change-analysis>结构化分析结果，供orchestrator路由决策
操作指令: 分析变更请求 (analyze)
Step 1: 变更描述解析
提取变更的核心意图:
- 涉及哪些功能领域 (用户故事/模块/接口/页面)
- 变更的性质 (新增/修改/删除)
- 预期影响范围
Step 2: 文档覆盖度扫描
数据源（自动）：对每个已识别的实体 ID 取追溯链——cataforge kg trace <id> --direction both --output json 取上下游追溯（PRD→ARCH→UI-SPEC→DEV-PLAN 全链路），配合 --coverage 取全局 Feature 覆盖矩阵，一次性定位"哪个 Feature 已有 / 缺实现 / 缺测试"；追溯后端不可达时经 context 检索已有文档逐级核对。后端选择由框架路由，无需在此判断。
按以下结构逐级检查:
- PRD: 搜索相关功能 (F-NNN)、用户故事、验收标准 (AC-NNN)
- ARCH: 搜索相关模块 (M-NNN)、接口 (API-NNN)、数据模型 (E-NNN)
- UI-SPEC (如存在): 搜索相关组件 (UC-NNN)、页面 (P-NNN)
- DEV-PLAN (如存在): 搜索相关任务 (T-NNN)
记录每级文档的匹配结果:
covered: 变更已被文档明确描述partial: 文档涉及相关领域但未完全覆盖该变更missing: 文档中无相关内容conflicting: 变更与文档现有描述矛盾
Step 3: 变更分类
根据文档覆盖度结果分类:
| 覆盖度结果 | 变更类型 | 说明 |
|---|---|---|
| 所有相关文档均 covered | clarification |
变更已有文档支撑，仅需澄清实现细节 |
| 至少一级文档 partial/missing，无 conflicting | enhancement |
变更扩展已有行为，需修订受影响的文档 |
| 存在 conflicting，或 PRD 级 missing | new_requirement |
变更引入新功能或与现有设计矛盾，需从PRD开始cascade |
Step 4: 影响分析
clarification 类型直接 drift_level = n/a、action = proceed，跳过下方深度分析。对 enhancement 和 new_requirement 类型，进一步分析:
Drift Level (偏移等级) 判定锚点:
| Level (action) | 判定锚点 | 示例 |
|---|---|---|
| n/a (proceed) | clarification 类型，所有相关文档均 covered，无任何 ID 增删改 |
澄清措辞 |
| L1 (proceed) | 仅修改文档措辞，不新增/删除/修改任何 F-xxx/M-xxx/API-xxx/E-xxx/T-xxx ID | 修改字段描述、补充注释 |
| L2 (amend_then_proceed) | 修改现有 ID 的定义或新增 ID，但不涉及 arch#§1 架构概览中的系统边界 | 增加API参数、修改验证规则、调整UI交互 |
| L3 (cascade_amendment) | 涉及 arch#§1 系统边界变更、新增/删除顶层模块、或技术栈变更 | 新增模块、改变数据模型 |
受影响文档 (affected_docs):
- 列出需要修订的文档
doc_id#section引用 - 按上游到下游排序: PRD → ARCH → UI-SPEC → DEV-PLAN
路由动作 (action): 见 ORCHESTRATOR-PROTOCOLS §Change Request Protocol。
Step 5: 输出分析结果
返回结构化结果供orchestrator解析:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 98 lines · 28 tokens per session scan A 51d4428a3e47
change-guard is a skill published in the GitHub repository lync-cyber/CataForge (128 stars, last pushed 1mo ago), licensed MIT. It adds 28 tokens to every session and 1,553 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…