Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lync-cyber/cataforge/framework-reviewnpx skills add lync-cyber/CataForge --skill framework-reviewgit clone --depth 1 https://github.com/lync-cyber/CataForgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lync-cyber/cataforge/framework-review)<a href="https://agentmods.dev/skills/lync-cyber/cataforge/framework-review"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/framework-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00118 | $0.05028 |
| Opus 5 | $0.00059 | $0.02514 |
| Sonnet 5 | $0.00024 | $0.01006 |
| Haiku 4.5 | $0.00012 | $0.00503 |
Grade A, and why
framework-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.
框架元资产审查 (framework-review)
能力边界
- 能做: 审查
.cataforge/下的 agents / skills / hooks / rules 元资产；对账 SKILL.md ↔ CHECKS_MANIFEST；交叉引用图完整性；裸常量数值检测；workflow phase × agent × skill 覆盖矩阵；agent model_tier 合规 - 不做: 修改被审元资产（仅产报告）；审查 src/ 下的业务代码；审查 IDE 厂商 profile 漂移
输入规范
- scope: agents | skills | hooks | rules | workflow | all
- 可选
--focus: 限定子检查组（组级 ID B1…B9，逗号分隔；不支持B1-α子粒度写法——CLI 只按组匹配，子粒度值会静默匹配不到任何检查） - 可选
--target <asset_id>: 仅审单个 agent / skill 名（Layer 2 节省 token；Layer 1 仍按 scope 全跑） - 项目根下的
.cataforge/目录（必读） cataforge.runtime.skill.builtins.*.CHECKS_MANIFEST（B3 对账数据源，从已安装的 cataforge 包导入）cataforge.runtime.hook.scripts.*(B6-α/β script 可达性 + ast.parse 数据源)cataforge.core.types.CAPABILITY_IDS/EXTENDED_CAPABILITY_IDS(B6-γ matcher 校验集)framework.json#/constants/AGENT_MODEL_DEFAULTS+AGENT_MODEL_TIER_HEAVY_WHITELIST(B7 数据源)framework.json#/dispatcher_skills(B5-α 区分 skill-as-router vs 未定义 agent)
输出规范
- 框架审查报告:
docs/reviews/framework/FRAMEWORK-REVIEW-{scope}-{YYYYMMDD}-r{N}.md - 审查结论: approved / approved_with_notes / needs_revision
推荐触发路径
framework-review 是按需触发的元资产审查，不进入业务流程主循环。推荐的合规触发面：
- 用户手动:
cataforge skill run framework-review -- all（或具体 scope） - CI 守卫: 在 PR pipeline 增加一步
cataforge skill run framework-review -- all --focus B1,B2,B3,B7，仅 FAIL 时阻塞合并 - doctor 深扫:
cataforge doctor --deep可选附带 framework-review 全量 - 可配合:
cataforge viz framework渲染编排图，与本 skill 的结构发现对照核验 - 不要: 让 reviewer agent 在业务流程内自动调起（reviewer.allowed_paths 不覆盖此报告路径，会污染审查独立性）
操作指令: 框架审查 (review)
Step 1: Layer 1 — 静态结构检查
执行: cataforge skill run framework-review -- {scope} [--focus B1,B2,B3,B4,B5,B6,B7,B8,B9]
返回码语义按 §Layer 1 调用协议。各子检查的判定语义与失败级别见 §Layer 1 检查项；scope → 子检查组映射:
| scope | 子检查 |
|---|---|
| agents | B1-α/β, B2-α, B4-α, B7-α/β/γ, B8-α/β/γ |
| skills | B1-α/β, B2-α/β, B3-α/β/γ, B4-α, B8-α/β/γ |
| rules | B1-β, B4-α |
| hooks | B6-α…ε |
| workflow | B5-α…ζ, B9-α/β/γ |
| all | B2, B5, B6, B7, B8, B9 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 164 lines · 118 tokens per session scan A e2af650dc55c
framework-review is a skill published in the GitHub repository lync-cyber/CataForge (128 stars, last pushed 1mo ago), licensed MIT. It adds 118 tokens to every session and 5,028 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…