Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add medalsoftchina/workcopilot --skill doa-harnessgit clone --depth 1 https://github.com/medalsoftchina/workcopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/medalsoftchina/workcopilot/doa-harness)<a href="https://agentmods.dev/skills/medalsoftchina/workcopilot/doa-harness"><img src="https://agentmods.dev/badge/skills/medalsoftchina/workcopilot/doa-harness/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/medalsoftchina/workcopilot/doa-harness"><img src="https://agentmods.dev/badge/skills/medalsoftchina/workcopilot/doa-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00129 | $0.04828 |
| Opus 5 | $0.00064 | $0.02414 |
| Sonnet 5 | $0.00026 | $0.00966 |
| Haiku 4.5 | $0.00013 | $0.00483 |
Grade A, and why
doa-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 424 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DOA Harness — 一键搭建 Copilot 工程轨道（团队版）
核心理念
Copilot 的上限不取决于提示词，而取决于它运行在怎样的工程轨道上。 三层公式：Context（给什么）→ Constraints（守什么）→ GC（清什么）。
运行模式
| 模式 | 触发方式 | 行为 |
|---|---|---|
| 初始化 | 首次运行（默认） | 完整探测 → 交互确认 → 生成全部 5 类文件 |
| 增量更新 | 参数含 --update |
扫描已有文件 → 仅 patch 新增部分（如新模块），保留用户自定义内容 |
| 预览模式 | 参数含 --dry-run |
执行探测和模板渲染，输出预览但不写入文件 |
工作流
调用 skill
→ Step 0: 判断运行模式（初始化 / 增量更新 / 预览）
→ Step 1: 深度探测项目结构与技术栈
→ Step 2: 交互确认关键信息
→ Step 3: 生成 / 更新 5 类配置文件
→ Step 4: 注入 GC 指令
→ Step 5: 验证完整性 & 一致性
→ Step 6: 输出 Day-1 验证指令
Step 0: 判断运行模式
- 检查参数中是否含
--update或--dry-run - 扫描工作区，检查
.github/copilot-instructions.md是否已存在- 已存在且未指定
--update：提示用户 "Harness 已初始化，是否切换到增量更新模式？" - 不存在：进入初始化模式
- 已存在且未指定
Step 1: 深度探测项目结构与技术栈
1.1 递归扫描子项目
不再只看根目录。用 list_dir 递归扫描根目录及一级子目录，收集所有包含信号文件的子项目：
扫描策略：
1. list_dir 根目录 → 识别子目录
2. 对每个子目录 list_dir → 查找信号文件
3. 构建子项目列表: [{name, path, stack, signals}]
1.2 信号文件匹配表
| 信号文件 | 技术栈大类 | 需要进一步读取 |
|---|---|---|
package.json + tsconfig.json |
Node/TypeScript | 读 package.json → 判断具体框架 |
*.csproj / *.sln |
.NET | 读 .csproj → 判断 SDK 版本和项目类型 |
pyproject.toml / requirements.txt |
Python | 读依赖列表 → 判断框架 |
go.mod |
Go | 读 go.mod → 判断主要依赖 |
Cargo.toml |
Rust | 读 Cargo.toml |
pom.xml / build.gradle |
Java/Kotlin | 读构建文件 |
1.3 前端框架深度探测
当检测到 package.json 时，必须读取其 dependencies / devDependencies 来判断：
| 依赖关键字 | 识别为 | 典型配套 |
|---|---|---|
umi / @umijs/* |
UmiJS | Ant Design Pro · dva · umi-request |
next |
Next.js | App Router / Pages Router |
nuxt |
Nuxt | Vue 3 |
vue (无 nuxt) |
Vue SPA | Vue Router · Pinia · Axios |
react (无 umi/next) |
React SPA | React Router · 状态管理待探测 |
@angular/core |
Angular | RxJS · NgRx |
svelte / @sveltejs/kit |
Svelte/SvelteKit | — |
同时检测：
- 包管理器: 检查
yarn.lock→ Yarn |pnpm-lock.yaml→ pnpm |package-lock.json→ npm - CSS 方案: 检查
tailwind.config.*→ Tailwind |.less文件 → Less |*.module.css→ CSS Modules - 状态管理: 检查依赖中的
zustand/dva/redux/pinia/vuex/ahooks - 请求层: 检查
axios/umi-request/@tanstack/react-query/swr - 测试框架: 检查
vitest/jest/@testing-library/*/cypress - Lint 工具: 检查
eslint/prettier/biome
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 424 lines · 129 tokens per session scan A b33a56f2708c
doa-harness is a skill published in the GitHub repository medalsoftchina/workcopilot (4 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 129 tokens to every session and 4,828 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
architecture-diagram
Build interactive, click-through architecture diagrams for software systems — a self-contained single HTML file with animated step-by-step flows, mode toggles (dev/prod, offline/online, v1/v2), dark/light theme, and a side panel with payload details, plus a companion markdown description. Use when the user wants to…
issue-authoring
Draft or refine IDD-ready GitHub issues, roadmap issues, and sub-issues before the normal IDD execution loop begins. Use when a request is too large or ambiguous for one reviewable change, when work needs decomposition or dependency encoding, or when the user asks for issue drafting, roadmap planning, or…
routeros-mac-telnet
MAC-Telnet protocol (MikroTik Layer-2 terminal/exec over UDP 20561) wire format, session handshake, and MD5 + MTWEI (EC-SRP) authentication. Use when: implementing or debugging a MAC-Telnet client/server, reaching a RouterOS device by MAC address without IP, parsing MAC-Telnet packets, understanding the WinBox-style…
routeros-app-yaml
RouterOS /app YAML format for container applications (7.21+ builtin app, 7.22+ custom YAML creation). Use when: writing or validating RouterOS /app YAML files, working with MikroTik container apps, building docker-compose-like definitions for RouterOS, creating /app store schemas, debugging /app validation errors, or…
routeros-command-tree
RouterOS command tree introspection via /console/inspect API. Use when: building tools that parse RouterOS commands, generating API schemas from RouterOS, working with /console/inspect, mapping CLI commands to REST verbs, traversing the RouterOS command hierarchy, or when the user mentions inspect, command tree, RAML…
routeros-container
RouterOS /container subsystem for running OCI containers on MikroTik devices. Use when: enabling containers on RouterOS, setting up VETH/bridge networking for containers, managing container lifecycle via CLI or REST API, building OCI images for RouterOS, configuring container environment variables, troubleshooting…