Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/objectstack-ai/objectstack/checklist-testnpx skills add objectstack-ai/objectstack --skill checklist-testgit clone --depth 1 https://github.com/objectstack-ai/objectstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00165 | $0.04612 |
| Opus 5 | $0.00082 | $0.02306 |
| Sonnet 5 | $0.00033 | $0.00922 |
| Haiku 4.5 | $0.00016 | $0.00461 |
Grade A, and why
checklist-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Checklist test —— 对着活的应用执行选中的测试项
你把一个选择器解析成一组清单测试项,在隔离环境把应用拉起来,在浏览器 / API 上驱
动每一项的步骤,并产出一份运行记录。逐条款判定的方法(判定词、oracle 层级、证
据、防误报自查)是 docs/qa/platform-checklist/RUNNER.md —— 先读它、服从它;本
技能只是触发器、选择契约与隔离/并行方案,不是 runner 协议的第二份拷贝。
环境知识(启动、dist 构建模型、vendored-console 陷阱、浏览器逃生舱)在
dogfood-verification 技能 —— 也要读。你不是在重新发明怎么启动;你是在对着一次
启动执行一份具体清单。
0. 解析选择器 —— 确定性的,不许猜
永不肉眼挑测试项。问解析器:
node scripts/checklist-select.mjs <selector> --json
选择器(每次运行一个):
| selector | 跑什么 |
|---|---|
platform-core.console-login(裸 id) |
那一项 |
area:records-forms(或裸 records-forms) |
该区全部测试项 |
records-forms.json(或完整 …/areas/records-forms.json 路径) |
该区全部测试项 —— 列目录看到的文件名不带前缀也能用 |
capability:hook |
coverage.json 里映射到某个元数据种类的项 |
priority:P0 |
常备冒烟 |
surface:api |
全部 API 面测试项(便宜 —— 不需要浏览器构建) |
since:v17 |
某个 release 引入的全部项(release-sweep 过滤器) |
file:packages/plugins/plugin-approvals/src/approval-service.ts |
source[] 引用该文件的项 ——「测覆盖这个文件的一切」(带 / 或代码扩展名的裸路径也自动按 file: 解析) |
all |
整份清单 |
--json 给出可运行清单(id · priority · surface · revision)。Blocked 项默认排
除 —— 它们在现成 fixture 上跑不起来;只有要把它们带着 fixture 理由记录成
blocked 时才传 --include-blocked。把解析器报出的 revision 钉进运行记录:
判定只对它运行时所对的那个 revision 有效。
1. 规划这一轮 —— 只构建需要的,钉住的先跑
读命中项的 surface:
- 全是
api/build/cli→ 不需要 console 构建。把框架拉起来 (objectstack dev),驱动 REST/CLI。快(分钟级)。 - 有任何
browser/mixed→ 需要 vendored console dist。它与 showcase 工作区 闭包分开构建(pnpm objectui:build,从钉住的.objectui-sha构建);它存在 之前,第一次启动对/_console/是 404(dogfood §2 —— 真实前置条件,记录它,不要 伪造 block)。给构建留预算(冷 monorepo 上 ~10–30 分钟);它占掉大头,浏览器驱动 只是分钟级。
整轮只构建一次,提前建好。
复用一棵已配好的树 —— 整轮最大的开销是环境,不是测试项。 实测同一份清单、同一 个 subject sha:复用现成树的一轮跑完了它的区;三个冷容器在给出第一条判定之前就各自 烧掉了大半预算(install、console 构建顺序、缺失的 CLI dist),合计留下约三分之二的 区没跑。默认复用已配好的树;每轮开一个冷容器,只在这一轮必须活得比派发会话 久时才值(长时间浏览器运行、dogfood)。
按 tier 排序,钉住的先跑、按区批量。 解析器给出的 automated.ref 是最便宜的切
分:
- Tier 1 —— 带
automated.ref的项:按区批量,一次 vitest 覆盖该区全部钉住 的文件,一条命令为多项取证(RUNNER 规则 6:不重证自动化已钉住的东西)。 - Tier 2 —— 无 pin 的 P0/P1:手工驱动。sweep 的真实价值集中在这里。
- Tier 3 —— 无 pin 的 P2:除非有改动触达,否则押后。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 239 lines · 165 tokens per session scan A 530c054ab24c
checklist-test is a skill published in the GitHub repository objectstack-ai/objectstack (45 stars, last pushed 2d ago), licensed Apache-2.0. It adds 165 tokens to every session and 4,612 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ontotect
Systematic ontology engineering for designing, constructing, reviewing, repairing, optimizing, refactoring, validating, documenting, and governing ontologies, vocabularies, taxonomies, knowledge graphs, semantic models, and mappings. Use for RDF/RDFS, OWL 2, SKOS, SHACL, SPARQL, OBO, Turtle, JSON-LD, RDF/XML…
mykg
Run mykg knowledge-graph commands inside Claude Code from one slash command /mykg. The user describes intent in natural language (extract, append, resume, approve, walkthrough, parse-docs, fetch-web, query); the skill parses intent, builds the right mykg CLI command from the live --help output, confirms, runs it, and…
mykg-github-pages
Set up and maintain the GitHub Pages site for the mykg repo (SenolIsci/mykg) — a purpose-built pages/ folder (landing page adapted from README.md, blog posts, diagrams), built by a GitHub Actions workflow that runs Jekyll and deploys the result to a gh-pages branch. Use whenever the user wants to publish project…
networkx
Build, analyze, and visualize networks and graphs using NetworkX (Python). Use this skill whenever the user wants to: create graphs or networks, analyze graph properties, compute centrality measures, find shortest paths, detect communities, run graph algorithms, convert graphs to/from matrices or dataframes, visualize…
design-architecture
Reviews the current codebase architecture and proposes improvements using four parallel specialist subagents: System Architect, Software Architect, Data Architect, and an Adversarial Architect that red-teams failure paths, LLM adversarial output scenarios, silent corruption risks, and invariant bypasses. Each subagent…
exchange-recovery
Accident Request (用户输入事故请求) ↓ Think (分析事故 → 决策恢复策略) ↓ Risk Evaluate (评估数据覆盖风险) ↓ Plan (列出Exchange服务器 → 查找备份时间点 → 浏览备份邮件 → 生成恢复任务) ↓ Act (执行恢复任务 → 产生恢复作业 → 验证Exchange可用性) ↓ Report (生成恢复报告：状态 + 数据统计 + 时效评估).