Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Minokun/xdev --skill xdev-askgit clone --depth 1 https://github.com/Minokun/xdevWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/minokun/xdev/xdev-ask)<a href="https://agentmods.dev/skills/minokun/xdev/xdev-ask"><img src="https://agentmods.dev/badge/skills/minokun/xdev/xdev-ask.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.02623 |
| Opus 5 | $0.00005 | $0.01311 |
| Sonnet 5 | $0.00002 | $0.00525 |
| Haiku 4.5 | $0.00001 | $0.00262 |
Grade A, and why
xdev-ask scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/xdev-ask — 项目问答与体检
问题 / 指令： 用户消息（手势之外的原文）
原则与边界
最终答案正确 > 其它一切；做不到就诚实标注，绝不用过时数据给自信答案。
高影响否定性结论的举证深度：断言"X 不支持 / 不消费 Y"这类否定性结论前，必须追到 Y 的 消费链最底层（Y 的实现处，不是引用处）才可下结论——只看了调用方没看实现层，只能记入 Unknowns 不得写成 Finding。引用处的缺席 ≠ 实现处的不存在。
只读。允许：读文件、rg、graphify query / check-update / update、为答案正确而做的图谱刷新或建图（graphify-out/ 是唯一允许写入的位置）。禁止：改源码、跑测试 / 构建 / 迁移、任何 git 写操作、graphify install|watch|hook、Graphify 之外的网络调用。用户要求改代码 / 跑测试 / 部署 → 停下，建议切 /xdev-iterate / /xdev-bugfix / /xdev-full-dev；问"怎么改 / 如何实现"属正当问答，照答。
模式判定
用户消息（手势之外的原文） |
模式 |
|---|---|
| 含具体锚点（文件 / 函数 / 路由 / 组件 / 业务名词 / 调用链） | 问答 |
| 空 / "体检" / "有什么风险" / "审一下" | 体检（6 维清单） |
| 单一维度词（"安全" / "测试" / "架构" / "死代码" / "可观测性"） | 聚焦体检该维 |
| 不在 6 维内的泛词（"性能" / "体验"） | 反问一句让用户具体化，不强转体检 |
| 多问题混合 | 拆分后按重要性串行答，TL;DR 提示优先级 |
| 过泛无锚点（"这项目怎么样"） | 给 2–3 个可答方向 + 各 1 句预答，让用户挑 |
Graphify（有则用，无则 rg）
已安装 Graphify 视为隐式授权：刷新 / 建图自动执行，只披露代价（涉及的非代码资料清单 + 参考 cost.json 历史的成本 / 时延），不二次确认。用户说"别刷新 / 别建图 / 用现状回答"→ 立即跳过所有图谱写操作，在 Unknowns 注明。
状态判定（command -v graphify 失败 → 直接 rg 降级）：
graphify-out/下graph.json/manifest.json/cost.json任一缺失 → 图谱不完整，按首次建图处理- 三件套齐全 → 新鲜度：
graphify check-update .非空，或git status --porcelain有源码改动，或find . -newer graphify-out/manifest.json -type f（排除.git/node_modules/.venv/dist/build/graphify-out/ 缓存）有源码文件 → 过期。多信号取或，不用单一信号反证清白。
工具怪癖（模型自己不知道，必须遵守）：
check-update偶有漏报，所以要叠加 git / mtime 信号- 比较
cost.json构建时间与git log -1 --format=%aI时必须用datetime.fromisoformat归一化——前者 UTC+微秒、后者本地偏移，字符串直接比较在负时区会把过期图谱误判新鲜 graphify update .只做本地 AST 刷新（无 LLM，秒级），只覆盖源码变化；*.md/ 图片 / PDF /docs/等语义资料变化或首次全量建图，CLI 没有等价命令，必须走/graphifyskill pipeline（调 LLM API）。当前环境不能调 slash → 通知用户并 rg 降级- 非 git 仓库：git 信号为空，仅靠
check-update+ mtime，在Unknowns声明
首次建图前先判断是否需要：局部问题（单文件 / 单函数，rg 可独立回答）不建图；架构 / 调用链 / 体检 / 跨模块影响面才建。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 130 lines · 11 tokens per session scan A 036185fce052
xdev-ask is a skill published in the GitHub repository Minokun/xdev (24 stars, last pushed yesterday), licensed MIT. It adds 11 tokens to every session and 2,623 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
diagnose
Trace from a reproduced symptom to the source code that causes it. Pin the specific file and approximate line, rate confidence in the cause and clarity of the fix independently, and always propose a concrete fix.
repro-admin
Reproduce an EmDash admin UI bug. Attach a container, start the demo dev server, drive the admin with agent-browser using the dev-bypass session, and capture the reproduction as screenshots plus a replayable transcript.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…
byted-util-volcengine-detect-retry
An orchestration workflow for Volcengine Cloud Detect, a service that checks websites or network endpoints from test locations.