Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lync-cyber/CataForge --skill feature-walkthroughgit clone --depth 1 https://github.com/lync-cyber/CataForgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lync-cyber/cataforge/feature-walkthrough)<a href="https://agentmods.dev/skills/lync-cyber/cataforge/feature-walkthrough"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/feature-walkthrough.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00156 | $0.01696 |
| Opus 5 | $0.00078 | $0.00848 |
| Sonnet 5 | $0.00031 | $0.00339 |
| Haiku 4.5 | $0.00016 | $0.00170 |
Grade A, and why
feature-walkthrough scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
功能走查 (feature-walkthrough)
能力边界
- 能做: 按 spec（prd/arch/ui-spec/dev-plan 的功能条目）对交付实现做逐条符合性判定；对走查范围内代码做健康度扫描（可复用 code-review scan 的机检 probe）；用真实数据路径启动真实服务动态复现，验证跨模块接缝的实际行为；产出可直接转录进 code-review 报告 / CORRECTIONS-LOG 的走查记录
- 不做: 修改代码（仅报告，修复走标准 dev 流程）；替代 code-review 的任务粒度审查（互补：本 skill 以功能条目为单位、含符合性维度）；替代 sprint-review 的完成度审查（那是任务/AC 账面核对，本 skill 验运行态行为）；框架元资产走查（framework-walkthrough 负责）
两层正交判定
每个功能条目回答两个独立问题：
| 层 | 问题 | 判定值 |
|---|---|---|
| 第一层·符合性 | 功能兑现 spec 了吗 | missing（缺失）/ drift（偏离）/ bug（错误）/ pass（通过） |
| 第二层·健康度 | 代码本身健不健康 | COMMON-RULES §统一问题分类体系 code category（structure / dead-code / duplication / complexity / coupling / test-quality / consistency …）+ severity + root_cause |
第二层与 code-review 共用 category / severity / root_cause 口径，走查发现可无缝进 code-review 报告与 CORRECTIONS-LOG 流程。
输入规范
- 必选：走查目标 —— 功能域名称 / 页面 / spec 条目引用（如
prd#§2.F-003）；all表示全功能清单 - 可选
--scope <dir>: 限定代码扫描目录，缺省从 spec 条目的 traceability 推断 - 可选
--round <N>: 走查轮次，缺省自动递增（当日同 scope 已有 r1 则 r2） - spec 事实源：经
cataforge context read按条目粒度加载 prd / arch / ui-spec / dev-plan 相关章节，不整篇加载 - 第二层机检入口：
cataforge skill run code-review -- scan <scope> [--focus <category,...>]
执行步骤（五步走查法，每个功能条目）
- 读意图 — 加载该条目的 spec 原文（功能描述 + AC + 关联 UI/接口契约）
- 对设计 — 找到承接该条目的模块/组件/入口，核对架构映射（traceability 边或代码引用）
- 查实现 — 沿调用链读实现，标记与 spec 的差异候选
- 跑符合性 — 用真实数据路径起真实服务，实际操作/调用该功能，判定
missing|drift|bug|pass - 扫质量 — 对该条目触达的代码区块跑第二层健康度（机检 probe + 人工核验），按统一分类体系记录
前四步查符合性，第五步扫质量；两层结论互不覆盖。
真实数据动态复现（硬纪律）
- 符合性判定必须以真实数据路径起真实服务的观察为准——桩数据/替身测试系统性漏「页面↔聚合器」等跨模块接缝，替身还可能引用已废弃的取值使断言失真
- 绿色单测/门禁不构成
pass证据；pass需引用运行态观察（实际输出、界面渲染、接口响应） - 无法启动真实服务时如实记
blocked并写明障碍，不降级为看代码推断
编排（可选加速）
- 按正交区块（功能域 / 页面 / 端到端流 / 边界条件）派发并行子代理分区走查
- 主线程对子代理上报的 HIGH 级发现独立复核（重跑其复现路径），防误判与门禁套利
- 单轮建议 ≤ 一个功能域，超出拆多轮
输出规范
- 走查报告:
docs/reviews/walkthrough/WALKTHROUGH-{scope}-{YYYYMMDD}-r{N}.md，front matterid: walkthrough-{scope}-{YYYYMMDD}-r{N}、doc_type: walkthrough、status: draft|approved（字段按.cataforge/references/review-report-spec.md） - 走查记录一行一条，字段与
.cataforge/references/review-report-spec.md§问题格式 对齐：编号（W-NN）/ 位置 / 符合性判定 / 质量 category / severity / root_cause / 现象 / 证据（运行态观察引用） - 发现的修复走标准 dev 流程；HIGH 及以上同步记 CORRECTIONS-LOG
- 模拟器盲区回灌：走查发现外部系统模拟器/mock 与真实系统行为的差异时，回灌为该模拟器的回归 fixture；契约见
external-truth-first.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 74 lines · 156 tokens per session scan A 6527acaaad09
feature-walkthrough is a skill published in the GitHub repository lync-cyber/CataForge (128 stars, last pushed 1mo ago), licensed MIT. It adds 156 tokens to every session and 1,696 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.
test-warp-ui
Guides testing Warp UI features and changes using the computer use tool. Use this skill only when computer-use testing was requested (explicit request or accepted offer) and the computeruse tool is available to the agent. Covers launching Warp and verifying UI behavior.
test-electron-app
Drive the real running PostHog Electron app (live tRPC, workspace-server, real data) over CDP with agent-browser. Connect to the running app on port 9222, test desktop changes against a local Django stack, snapshot the accessibility tree, inspect network requests, and screenshot only when explicitly asked. Use when…
pyats-dynamic-test
Generate and execute deterministic pyATS aetest validation scripts - interface state, OSPF neighbors, BGP paths, ping matrices, and custom compliance tests. Use when writing a network test, validating post-change state, running pass/fail checks, or building automated regression tests.
trailblaze
Use when working with Trailblaze — natural-language device control for coding agents across iOS, Android, and web, with replayable .trail.yaml files as the artifact. Trigger on mentions of Trailblaze, the trailblaze CLI, .trail.yaml files, trailmaps, waypoints, or requests to drive / author / debug / run UI tests on…
Detox Mobile Testing
Gray-box end-to-end testing for React Native apps with Detox. Covers .detoxrc.js configuration, build and test commands, matchers, device.launchApp control, automatic synchronization, and macOS CI pipelines.