Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/movebrickschi/harness-engineering-mcp/dev-flow-fullnpx skills add movebrickschi/harness-engineering-mcp --skill dev-flow-fullgit clone --depth 1 https://github.com/movebrickschi/harness-engineering-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/movebrickschi/harness-engineering-mcp/dev-flow-full)<a href="https://agentmods.dev/skills/movebrickschi/harness-engineering-mcp/dev-flow-full"><img src="https://agentmods.dev/badge/skills/movebrickschi/harness-engineering-mcp/dev-flow-full.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00110 | $0.03235 |
| Opus 5 | $0.00055 | $0.01618 |
| Sonnet 5 | $0.00022 | $0.00647 |
| Haiku 4.5 | $0.00011 | $0.00324 |
Grade A, and why
dev-flow-full scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 248 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dev Flow Full - 完整需求开发流程
适用场景
- PM 给了一个原型/参考项目(A),用于理解业务
- 实际开发在另一个项目(B)中进行
- 需要完整经历"探索 → 理解 → 设计 → 开发 → 测试 → 上线 → 复盘"全流程
核心原则(必须严格遵守)
- A 项目只读:进入 A 项目立即
/freeze+ SwitchMode 进 plan 模式 - 强制卡点:4 个硬卡点必须使用
AskQuestion工具阻塞,严禁自行判断"我觉得 OK"继续 - 垂直切片优先:水平铺开多 subagent 前必须先做最小端到端验证
- 失败可回退:每阶段失败有明确退路,不允许"将错就错"
- 产物可复用:所有中间产物落到
~/Projects/_requirements/[feature]/
启动参数收集
执行流程前,使用 AskQuestion 工具一次性收集以下参数(如用户消息中已提供则跳过对应项):
- 需求名称(用于命名知识库目录,建议英文 kebab-case,如
supplier-batch-approve) - 原型项目 A 路径(智能扫描
~/Projects/、~/Developer/、~/repos/推断后让用户确认) - 原型功能 URL(如
http://localhost:3000/admin/api/suppliers) - 目标项目 B 路径
- PM 联系人(用于沟通记录归档)
- 截止日期(可选)
收集后写入 ~/Projects/_requirements/[feature]/META.md(模板见 templates/META.md)。
流程执行
阶段 0:上下文初始化
- 检查/创建
~/Projects/_requirements/[feature]/目录 - 写入
META.md - 加载
~/Projects/_requirements/_lessons.md(如存在),将其内容作为本次开发的背景知识 - 输出本次开发的整体计划摘要
阶段 1:A 项目探索(只读)
- 使用
cursor-app-controlMCP 的move_agent_to_root切换到 A 项目 - 立即执行
/freeze锁定 A 目录,严禁修改 - 切换到 Plan 模式(SwitchMode 到 plan)
- 使用
cursor-ide-browserMCP 走查目标 URL:browser_snapshot抓取页面结构browser_take_screenshot全页截图- 依次点击所有可交互元素,记录 URL 变化
browser_network_requests抓取所有 API 请求browser_console_messages检查报错
- 并行派发 3 个 explore subagent:
- 任务 A:项目骨架(技术栈、目录结构、入口文件、构建脚本、运行环境特征)
- 任务 B:目标功能的前端实现(路由、组件、状态管理、API 调用层)
- 任务 C:目标功能的后端实现(路由定义、控制器、Service、数据库 Schema)
- 抽象化输出 4 份文档到
~/Projects/_requirements/[feature]/:BUSINESS_FLOW.md- 业务流程(用户故事 + 截图 + mermaid 流程图,禁止包含具体代码)API_CONTRACT.md- 接口契约(业务含义/入参/出参/错误码/幂等性,用通用描述,不绑定框架)DATA_MODEL.md- 数据模型(实体/字段/关系/枚举/校验,用通用 ER 描述)ENV_NOTES.md- A 项目运行环境特征(mock 数据?真实环境?特殊配置?)
阶段 2:需求循环 ⏸ 卡点 1(可循环)
- 调用
gstack-office-hours技能视角挑战需求文档 - 输出
questions-for-pm.md,包含:- 模糊不清的业务规则
- 缺失的边界场景(错误/并发/权限/空状态)
- 互相矛盾的地方
- 每个问题给出 AI 的猜测和需要 PM 确认的具体点
- 调用
AskQuestion工具阻塞等待,问题示例:prompt: "需求文档已生成,请查看 questions-for-pm.md。请选择:" options: - "已和 PM 沟通,提供答复(粘贴在下条消息)" - "需求清楚无疑问,进入下一阶段" - "需要重新探索 A 项目某些细节" - 收到 PM 答复后:
- 更新需求文档
- 追加到
pm-answers.md沟通记录 - 再次
AskQuestion询问"还有疑问吗?" - 循环至用户选择"无疑问,进入下一阶段"
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 248 lines · 0 tokens per session scan A 75743373549e
dev-flow-full is a skill published in the GitHub repository movebrickschi/harness-engineering-mcp (2 stars, last pushed 3mo ago), licensed MIT. It adds 110 tokens to every session and 3,235 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…