Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lync-cyber/cataforge/task-decompnpx skills add lync-cyber/CataForge --skill task-decompgit clone --depth 1 https://github.com/lync-cyber/CataForgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01498 |
| Opus 5 | $0.00024 | $0.00749 |
| Sonnet 5 | $0.00010 | $0.00300 |
| Haiku 4.5 | $0.00005 | $0.00150 |
Grade A, and why
task-decomp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
任务拆分 (task-decomp)
能力边界
- 能做: 功能→任务分解、复杂度评级、Sprint 初步划分、TDD 验收标准定义
- 不做: 架构决策、代码实现、测试执行、最终 Sprint 分组判定（依赖关系由 task-dep-analysis 计算并给出权威建议）
输入规范
- ARCH模块划分(M-{NNN}) + 接口契约(API-{NNN})
- UI-SPEC组件(UC-{NNN}) + 页面(P-{NNN})
输出规范
- 任务卡(T-{NNN})，每个包含:
- 目标、模块、接口、复杂度(S/M/L/XL)
- tdd_acceptance: 验收标准映射（GWT 格式，见执行流程 3）
- deliverables: 交付物文件清单
- context_load: context加载清单
- 实现提示(仅在必要时)
- Sprint划分表
- 依赖图 + 关键路径
- 集成/E2E测试规划: 按Sprint标注需验证的模块间交互和端到端用户流程
执行流程
- 从ARCH模块和接口推导任务
- 评估每个任务复杂度：跨越多个模块、或 context_load > 5 个章节、或步骤无法在单次 Agent 调用中枚举完整时，继续拆分
- 定义tdd_acceptance(映射AC)。每条 AC 采用 Given-When-Then 格式：
- Given: 前置条件（输入数据、系统状态）
- When: 触发动作（调用方法、发送请求、用户操作）
- Then: 可观测结果（具体返回值/字段、状态变化、错误类型+消息）
- Then 子句必须包含可断言的具体值或约束，禁止"实现 X"、"支持 Y"等无行为描述
- 契约完整性对账: AC 引用某
arch#§N.API-xxx契约时，把契约声明的全部响应码 / 安全路径 / 集成点逐一与派生 AC 交叉核验；每项须有对应 AC，无对应的须显式标[ASSUMPTION]豁免并附理由
- 定义deliverables(明确交付文件)
- 定义context_load(context引用)
- 建立依赖图: 调用 task-dep-analysis skill 计算拓扑/关键路径/环检测，再用
cataforge viz tasks --format mermaid产出 Mermaid 依赖图并写入 dev-plan#§2 - 按依赖关系划分Sprint(参考 task-dep-analysis 输出的 sprint_groups)，遵循 Sprint 切分原则:
- 每个 Sprint 的产出应包含至少一个用户可感知的完整功能
- 优先安排用户核心路径（
user_facing_critical_path: true）的任务到前几个 Sprint - Sprint 1 例外: 基础设施任务允许集中在首个 Sprint，不要求用户可感知功能
- 纯后端服务项目无此约束
- arch §1.5 external_oracles 非空时，Sprint 1 强制一张
walking_skeleton: true任务卡并作为规模化 Sprint 的 blocking dependency（契约见external-truth-first.md；doc-review Layer 1 强制）
- 插入验证任务: 每个包含
user_facing_critical_path: true任务的 Sprint 末尾，追加一个task_kind: validation的验证任务。验证任务不产出代码，orchestrator 遇到时暂停并向用户展示验证清单
Anti-Patterns
- 禁止: 单任务预估 LOC >
TASK_SPLIT_LOC或 AC > 6 条而不拆 —— 超此尺寸任务粒度不再单一，应在 task-decomp 阶段先拆 - 禁止: 把"重构 X"作为独立任务 —— 重构是 TDD REFACTOR 阶段的自然产物，独立 T-xxx 会让重构脱离测试安全网
- 禁止: deliverables 仅写 "实现 X 功能" 而不具体到文件路径 —— sprint-review 无法验证 AC 是否落到声明文件，验收形同虚设
- 避免: 任务横跨 ≥3 个
arch#§2.M-xxx—— 跨模块任务在 task-dep-analysis 输出中容易触发环依赖 - 禁止: AC 仅描述"实现 X 功能"/"支持 Y 格式" —— 模糊 AC 导致 test-writer 退化为存在性检查，无法推导断言期望值
- 禁止: AC 只覆盖被引用
arch#§N.API-xxx契约的正常路径 —— 如契约声明401 E_AUTH+403 E_PERMISSION_DENIED两条安全路径，AC 只测正常返回，缺口要到下游 code-review 标 HIGH 或 pre-wiring 审计才暴露 - 禁止: arch 模块为有序管线（stage 序列）时遗漏某 stage 的承载任务 —— 模块管线含 A→B→C 三 stage 而只为 A、C 建任务卡，B 接线无任务、以空返回满足下游字面 AC，运行时管线在 B 静默断裂；每个 stage 的接线须有任务卡 deliverables 承载
- 禁止: Sprint 内全部为后端任务而无任何用户可感知的功能交付（Sprint 1 例外），除非项目为纯后端服务
- 禁止: task-dep-analysis 报环依赖或无法计算拓扑序时仍输出任务计划 —— 环路使 Sprint 排期失真，应返回 blocked 附环路 task_id 链请人工拆环（COMMON-RULES §通用 Error Handling），不静默降级为无序计划
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 65 lines · 48 tokens per session scan A 2c966ec07828
task-decomp is a skill published in the GitHub repository lync-cyber/CataForge (128 stars, last pushed 1mo ago), licensed MIT. It adds 48 tokens to every session and 1,498 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wayfinder
Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.
setup-matt-pocock-skills
Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.
release-notes
Generate user-facing release notes from tickets, PRDs, or changelogs. Creates clear, engaging summaries organized by category (new features, improvements, fixes). Use when writing release notes, creating changelogs, announcing product updates, or summarizing what shipped.
retro
Facilitate a structured sprint retrospective — what went well, what didn't, and prioritized action items with owners and deadlines. Use when running a retrospective, reflecting on a sprint, creating action items from team feedback, or learning how to run effective retros.
bug-triage
Read all open bugs in production/qa/bugs/, re-evaluate priority vs. severity, assign to sprints, surface systemic trends, and produce a triage report. Run at sprint start or when the bug count grows enough to need re-prioritization.
flow-next-tracker-sync
Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.