Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/objectstack-ai/objectstack/checklist-authornpx skills add objectstack-ai/objectstack --skill checklist-authorgit clone --depth 1 https://github.com/objectstack-ai/objectstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00135 | $0.01090 |
| Opus 5 | $0.00068 | $0.00545 |
| Sonnet 5 | $0.00027 | $0.00218 |
| Haiku 4.5 | $0.00014 | $0.00109 |
Grade A, and why
checklist-author scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Checklist author —— 让测试清单保持诚实的 coverage sweep
规范方法住在 docs/qa/platform-checklist/SWEEP.md —— 先读它、照它执行;本技能
只是触发器与编排契约,不是流程的第二份拷贝。
你要产出什么
一份对 docs/qa/platform-checklist/ 的增量:areas/*.json 里新增/扩充的测试项、
对账后的 coverage.json、追加进 FOLLOW-UPS.md 的缺陷/文档漂移 —— 全部在
node scripts/check-platform-checklist.mjs 下校验为绿,并按 AGENTS.md
(worktree-first,PD#11)落在任务分支上。
编排契约
- Worktree 先行(PD#11):
git worktree add ../objectstack-<task> -b <branch> main。 全部编辑都在那里做。派发任何 agent 之前先读清单现状。 - 五个只读 gap hunter 并行 —— 每个 SWEEP.md 角度一个(console UI / spec 枚举 /
路由与运行时 / 内置应用 / 文档声称)。每个拿到:当前 item-id 清单、已知的 waiver
与 blocked 项(不重复上报),以及输出契约
surface | evidence path | coverage verdict | proposed id | sketch | fixture?。hunter 不写任何文件。 - 去重并入一个草稿登记表(落地前删掉)。跨角度的重复命中是高优先级信号,不是噪 音。
- 按区 writer agent —— 每个
areas/*.json文件一个 agent,writer 之间永不相 撞;除编排者外谁都不碰coverage.json与scripts/。每个测试项都遵守 README.md 的 deep-test 契约;缺 fixture 就记blocked/knownGaps,永不伪造覆盖。writer 断言之前把每个 endpoint、枚举、错误码都对到源码上 —— 把本技能的简报当假设,源码 才是真相。 - 集中对账:hunter 证明有现成 fixture 的种类一律解除 waiver(2026-08 那轮
sweep 里六条 waiver 有四条已过期 —— 每次都重审全部 waiver),新项映射进
coverage.json,新的 variants 矩阵钉上enumSource(见 README「Variants stay fresh automatically」)。 - 校验 + 落地:校验器绿,再提交到任务分支。产品缺陷与文档漂移进
FOLLOW-UPS.md;安全敏感的发现,没有维护者的决定永不公开立单。
规模指引
一轮全量 sweep ≈ 5 个 hunter + 8 个 writer agent。范围化的问题(「X 有测试吗?」) 只在相关角度跑一个 hunter,对清单核验后只补缺的 —— 契约相同,舰队更小。
没有子代理工具时,按角度顺序跑 —— 并在交付里声明这一轮是顺序执行的。 会话里不 存在 Task/子代理工具是允许的退化路径,不是阻塞;五个角度仍要逐个走完,一个都不省。 但 SWEEP.md 的全部主张是「不同角度捕获不同的遗漏类,因为读者彼此独立」:塌缩成 一个读者后,补上的测试项依然成立,「没有别的遗漏」这个结论不再成立 —— 不声明,就 没人分得清一轮降级的 sweep 和一轮完整的 sweep。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 63 lines · 135 tokens per session scan A 83426e7467fb
checklist-author is a skill published in the GitHub repository objectstack-ai/objectstack (45 stars, last pushed 2d ago), licensed Apache-2.0. It adds 135 tokens to every session and 1,090 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ontotect
Systematic ontology engineering for designing, constructing, reviewing, repairing, optimizing, refactoring, validating, documenting, and governing ontologies, vocabularies, taxonomies, knowledge graphs, semantic models, and mappings. Use for RDF/RDFS, OWL 2, SKOS, SHACL, SPARQL, OBO, Turtle, JSON-LD, RDF/XML…
mykg
Run mykg knowledge-graph commands inside Claude Code from one slash command /mykg. The user describes intent in natural language (extract, append, resume, approve, walkthrough, parse-docs, fetch-web, query); the skill parses intent, builds the right mykg CLI command from the live --help output, confirms, runs it, and…
mykg-github-pages
Set up and maintain the GitHub Pages site for the mykg repo (SenolIsci/mykg) — a purpose-built pages/ folder (landing page adapted from README.md, blog posts, diagrams), built by a GitHub Actions workflow that runs Jekyll and deploys the result to a gh-pages branch. Use whenever the user wants to publish project…
networkx
Build, analyze, and visualize networks and graphs using NetworkX (Python). Use this skill whenever the user wants to: create graphs or networks, analyze graph properties, compute centrality measures, find shortest paths, detect communities, run graph algorithms, convert graphs to/from matrices or dataframes, visualize…
design-architecture
Reviews the current codebase architecture and proposes improvements using four parallel specialist subagents: System Architect, Software Architect, Data Architect, and an Adversarial Architect that red-teams failure paths, LLM adversarial output scenarios, silent corruption risks, and invariant bypasses. Each subagent…
exchange-recovery
Accident Request (用户输入事故请求) ↓ Think (分析事故 → 决策恢复策略) ↓ Risk Evaluate (评估数据覆盖风险) ↓ Plan (列出Exchange服务器 → 查找备份时间点 → 浏览备份邮件 → 生成恢复任务) ↓ Act (执行恢复任务 → 产生恢复作业 → 验证Exchange可用性) ↓ Report (生成恢复报告：状态 + 数据统计 + 时效评估).