Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/movebrickschi/harness-engineering-mcp/dev-understandnpx skills add movebrickschi/harness-engineering-mcp --skill dev-understandgit clone --depth 1 https://github.com/movebrickschi/harness-engineering-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00109 | $0.01278 |
| Opus 5 | $0.00055 | $0.00639 |
| Sonnet 5 | $0.00022 | $0.00256 |
| Haiku 4.5 | $0.00011 | $0.00128 |
Grade A, and why
dev-understand scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dev Understand - 理解需求阶段
适用场景
完整开发流程的前置阶段。当 PM 给了原型项目，需要：
- 探索清楚业务流程
- 抽象化输出需求文档
- 通过 PM 沟通消除需求模糊点
- 为后续开发阶段（
/dev-implement）准备好需求知识库
核心原则
- A 项目只读：进入立即
/freeze+ SwitchMode 到 plan 模式 - 抽象化输出：禁止把 A 的具体代码搬到文档里，要翻译成业务语言
- PM 沟通可循环：支持多轮往返，用
AskQuestion阻塞等待
启动参数收集
使用 AskQuestion 工具一次性收集（用户消息已含则跳过）：
- 需求名称（kebab-case，如
supplier-batch-approve） - 原型项目 A 路径（智能推断后确认）
- 原型功能 URL
- PM 联系人
写入 ~/Projects/_requirements/[feature]/META.md。
流程执行
阶段 0：上下文初始化
- 创建
~/Projects/_requirements/[feature]/目录 - 写入
META.md - 加载
~/Projects/_requirements/_lessons.md（如存在）作为背景 - 输出执行计划
阶段 1：A 项目探索（只读）
move_agent_to_root切到 A 项目- 立即
/freeze+ SwitchMode 到 plan - 浏览器走查目标 URL：
browser_snapshot+browser_take_screenshot- 点击所有可交互元素
browser_network_requests抓 APIbrowser_console_messages查报错
- 并行派 3 个 explore subagent：
- 项目骨架（技术栈/结构/运行环境）
- 目标功能前端（路由/组件/状态/API 调用）
- 目标功能后端（路由/Controller/Service/Schema）
- 抽象化输出 4 份文档到
~/Projects/_requirements/[feature]/：BUSINESS_FLOW.md（业务流程，含截图、mermaid，无代码）API_CONTRACT.md（接口契约，业务语言）DATA_MODEL.md（数据模型，通用 ER）ENV_NOTES.md（A 的运行环境特征）
文档模板位置：~/.cursor/skills/dev-flow-full/templates/（统一维护，避免重复）：
META.md- 需求元信息BUSINESS_FLOW.md- 业务流程API_CONTRACT.md- 接口契约DATA_MODEL.md- 数据模型_lessons.md- 经验沉淀（已存在则追加）
读取模板后填充实际内容输出到 ~/Projects/_requirements/[feature]/。
阶段 2：需求循环 ⏸ 卡点（可循环）
- 用
gstack-office-hours视角挑战需求文档 - 输出
questions-for-pm.md：- 模糊业务规则
- 缺失边界场景
- 互相矛盾点
- 每个问题附 AI 猜测 + 需 PM 确认的具体点
- 调用
AskQuestion阻塞等待：prompt: "需求文档已生成，请查看 questions-for-pm.md。请选择：" options: - "已和 PM 沟通，提供答复（粘贴在下条消息）" - "需求清楚无疑问，结束理解阶段" - "需要重新探索 A 项目某些细节" - 收到 PM 答复后：
- 更新需求文档
- 追加到
pm-answers.md - 再次
AskQuestion询问"还有疑问吗？" - 循环至用户选择"无疑问"
完成标志
输出本阶段总结：
✅ 理解需求阶段完成
📁 知识库位置：~/Projects/_requirements/[feature]/
📄 产出文档：
- META.md
- BUSINESS_FLOW.md
- API_CONTRACT.md
- DATA_MODEL.md
- ENV_NOTES.md
- questions-for-pm.md
- pm-answers.md（如有）
下一步建议：使用 /dev-implement 进入开发实现阶段
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 121 lines · 0 tokens per session scan A d4d609540980
dev-understand is a skill published in the GitHub repository movebrickschi/harness-engineering-mcp (2 stars, last pushed 3mo ago), licensed MIT. It adds 109 tokens to every session and 1,278 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…