Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mileson/openprd --skill openprd-discovery-loopgit clone --depth 1 https://github.com/mileson/openprdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mileson/openprd/openprd-discovery-loop)<a href="https://agentmods.dev/skills/mileson/openprd/openprd-discovery-loop"><img src="https://agentmods.dev/badge/skills/mileson/openprd/openprd-discovery-loop/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mileson/openprd/openprd-discovery-loop"><img src="https://agentmods.dev/badge/skills/mileson/openprd/openprd-discovery-loop.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 90 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 91 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 92 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.03254 |
| Opus 5.5 | $0.00030 | $0.01302 |
| Sonnet 5.5 | $0.00015 | $0.00651 |
| Haiku 4.5 | $0.00008 | $0.00325 |
Grade A, and why
openprd-discovery-loop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenPrd Discovery Loop
概览
当用户要求 OpenPrd 持续推进、深度补全、完整覆盖或穷尽式梳理需求覆盖时，使用这份 skill。OpenSpec 仍然是支持的输出格式和兼容词汇，但 OpenPrd 才是负责路由、生成、校验和任务执行的主入口。
用户不需要知道 skill 名称或 CLI 参数。你要根据自然语言意图判断模式，再调用对应的 OpenPrd 内部命令。
自然语言触发词
当用户把 OpenPrd 或 OpenSpec 和这些意图词连在一起时，路由到这里：
- 持续、继续、一直推进、不断补全、长程
- 深度、深挖、深入梳理、深入分析
- 全面、完整、全量、穷尽、尽可能覆盖
- 大量扫描、只读扫描、跨模块证据收集、独立复核
- 补全、完善、生成规范、生成 OpenSpec、整理成任务
- 复刻、对标、参考这个项目、把这个项目逻辑转成规范
应该命中本 skill 的示例：
- “用 OpenPrd 深度补全这个项目。”
- “用 OpenSpec 深度补全这个项目。”
- “全面梳理现有项目，把规范和任务补齐。”
- “参考这个仓库，持续复刻它的产品逻辑到新项目。”
- “继续深挖这个需求，直到覆盖完整。”
不要要求用户显式说出 Use $openprd-discovery-loop。
模式
brownfield：检查现有项目，并把发现到的行为补充进覆盖项reference：检查参考项目，并把产品逻辑翻译成当前项目的 requirements、specs 和 tasksrequirement：持续追问和细化一个需求，直到它具备足够的范围、约束、流程、风险、验收标准和可执行任务
自动模式选择
替用户选模式：
- 当用户提供 GitHub 仓库、本地参考路径，或明确说复刻 / 对标 / 参考 / clone / parity 时，选
reference - 当目标是现有本地项目，且用户要求深度补全 / 全面梳理 / 扫描 / 完善时，选
brownfield - 当输入主要是想法、模糊请求、产品需求或功能概念，且没有单独参考项目时，选
requirement
如果意图混合：优先 reference；没有参考项目但有本地代码时优先 brownfield；两者都没有再用 requirement
大量只读扫描调度
当 OpenPrd discovery 需要大量只读扫描时，由主 agent 判断是否派发只读 subagent。日常任务仍由主 agent 先直接读取本地上下文；不要因为用户只说“看看、分析、梳理、定位、排查”就自动并行。
启动条件
- 用户明确要求深度分析、深入调研、全面梳理、多角度评估、交叉验证、并行排查、对标复刻或风险审查时，优先考虑只读 subagent。
- 任务需要同时阅读多个目录、文档、模块、日志、历史实现或参考项目，且并行收集证据能明显减少主上下文污染或节省时间时，可以启动。
- 任务涉及外部技术事实、公开仓库对标、复杂排障、发布风险或安全风险，且需要独立复核时，可以启动；仍必须遵守 Context7、DeepWiki、secrets-vault 和长文件门禁。
- 用户明确说“不用 subagent / 直接做 / 先别并行 / 只回答”时，不启动。
- 单文件小改、明确文案微调、简单命令、非常短的问题或清晰 bug 修复，默认不启动。
默认队形
- 一旦进入深度研究型 subagent 流程，默认使用 3 个只读 subagent：2 个独立调研执行者 + 1 个审查/交叉验证者。
- 最多启动 5 个 subagent：最多 4 个调研执行者 + 1 个审查者。只有任务天然拆成 4 个互不冲突的研究分支时才扩到 5 个。
- 每个 subagent 只回答一个清晰问题；不要让 subagent 再继续 spawn subagent。
- 主 agent 负责决策、整合和所有写入；subagent 只做快读、快扫、归纳、交叉验证，不直接修改文件、执行迁移、安装依赖、发布、提交表单、账号操作或删除文件。
- 主 agent 可以在 subagent 后台运行时继续做不冲突的本地工作；只有下一步确实依赖其结论时才等待。
角色选择
- 代码与文档调研：
spark-code-researcher、spark-doc-reader、documentation-explore - 对标复刻前置分析：
electron-parity-mapper - 安装、构建、发布或渠道排障：
release-diagnostics-researcher、channel-debug-researcher - 审查与风险扫描：
skill-workflow-reviewer、security-risk-researcher
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 8f66e7a94e76
- 1mo ago First seen · 194 lines · 76 tokens per session scan A f74b3b46eaa1
openprd-discovery-loop is a skill published in the GitHub repository mileson/openprd (50 stars, last pushed 1mo ago), licensed MIT. It adds 76 tokens to every session and 3,254 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
openspec-bulk-archive-change
Archive multiple completed OpenSpec changes at once. Use when archiving several parallel changes. Also use for a plural archive request - "openspec bulk-archive", "opsx bulk-archive", "openspec archive all", or "openspec archive these changes".
openspec-archive-change
Archive a completed OpenSpec change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete. Also use when the user says "openspec archive" or "opsx archive".
openspec-explore
Enter OpenSpec explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements in a project that uses OpenSpec. Use when the user wants to think through something before or during an OpenSpec change. Also use when the user says "openspec explore" or "opsx explore".
openspec-onboard
Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work. Also use when the user says "openspec onboard" or "opsx onboard".
openspec-verify-change
Verify implementation matches OpenSpec change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving. Also use when the user says "openspec verify" or "opsx verify".
openspec-sync-specs
Sync delta specs from an OpenSpec change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change. Also use when the user says "openspec sync" or "opsx sync".