Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/objectstack-ai/objectstack/dogfood-verificationnpx skills add objectstack-ai/objectstack --skill dogfood-verificationgit clone --depth 1 https://github.com/objectstack-ai/objectstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00128 | $0.03290 |
| Opus 5 | $0.00064 | $0.01645 |
| Sonnet 5 | $0.00026 | $0.00658 |
| Haiku 4.5 | $0.00013 | $0.00329 |
Grade A, and why
dogfood-verification scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -s -m3 -o /dev/null -w '%{http_code}' http://localhost:<port>/api/v1/health` → 200。 How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dogfood verification
启动并驱动真实应用的实战流程,教训换来的。三根支柱:隔离环境、吃透构建模 型、断言前先做视觉/权威核验。烧掉时间的地方都在跳过支柱 1 或 3。
0. 起飞前 —— 先隔离环境(第一件事)
dev 工作树、dev-server 端口、preview 浏览器全是共享的:并行的 Claude/dogfood 会 话会抢走浏览器标签页、留下挡住导航的未保存草稿、弄脏工作树。开工前先隔离:
- 自有端口:挑一个空闲的非默认端口(不要 3000/3001/3210)。先查:
lsof -nP -iTCP:<port> -sTCP:LISTEN。在.claude/launch.json加一条指向本 工作目录的具名配置,例如pnpm -C <abs>/examples/app-showcase exec objectstack dev --ui --seed-admin -p <port> -d file:/tmp/<run>/data.db。 - 自有数据:
--seed-admin在空 DB 上给出[email protected] / admin123。持 久化-d file:/tmp/<run>/data.db重启后仍在(适合多步配置的运行);--fresh给全新首跑(退出即清)。 - 确认独占控制:
preview_start后检查location.origin=== 你的http://localhost:<port>。标签页不断漂到你没导航过的应用/路由、或出现你没写过 的草稿 → 有并行会话占着浏览器。别跟它抢;把所有检查钉到你的绝对 origin, 靠 API + 源码(支柱 3)。 - 还要开 PR 的话,在基于
origin/main的独立 git worktree 里做(见 §5)—— 永不从共享的脏分支提交。
1. 启动
-
preview_start你在.claude/launch.json的具名配置;轮询就绪:curl -s -m3 -o /dev/null -w '%{http_code}' http://localhost:<port>/api/v1/health→ 200。 - Console UI 在
/_console/;应用在/_console/apps/<appId>(如com.objectstack.setup、com.objectstack.studio)。API 根/api/v1,设置/api/settings,合并后的应用/导航/api/v1/meta/app?id=<appName>。 - ⚠️
?id=键的是应用name,不是包 id。 真实 name 是showcase_app/setup/studio/account—— 不是上一行那种com.objectstack.setup/com.example.showcase(那是包 id,只在/_console/apps/的路径段上成立)。传 包 id 得到的是{"items":[]},读起来和「应用元数据没了」一模一样 —— 最高价值 的假 P0 形状。先不带 query 取一次/api/v1/meta/app,读它真正返回的 name, 再去过滤。
2. 构建/运行时模型 —— 攒一批,然后一次重启
- 包从
dist加载,不是src(pkg.main = dist/index.js)。编辑packages/*/src在重建该包并重启服务之前对运行时零效果。os dev的 watcher 只重编译示例应用自己的objectstack.config.ts/src,不管工作区的包。 - 所以:先做完全部源码编辑 →
pnpm --filter <pkg...> build→preview_stop+preview_start。不要每修一处就编辑→构建→重启一遍。 - ⚠️ 消融验证(predict-then-mutate)以最危险的方式继承这一条,而且它不是 dogfood
专属 —— mutate 腿与 restore 腿各自都要重建,并在报告里写明重建过。 判据是解析
路径:任何主体经依赖的
exports解析(→ 该包的dist/,且没有 vitest alias 把 specifier 拉回源码)的测试都中招,普通单元套件一样(这批 pair 的台账是scripts/check-test-source-alias.mjs的KNOWN_UNALIASED_TEST_IMPORTS)。忘记重 建修复是假红:费一圈,但会被发现。忘记重建消融跑的是突变前的构建,套件保持 绿,而这份绿会被记成「测试已被证明有区分度」—— 给一条可能根本红不了的断言 发了 证书,之后任何 CI 都暴露不了它(CI 构建正确,在那边永远绿);消融本就为证明新门 禁能失败时更毒 —— 那份绿读作「门禁没触发」,指向门禁坏了而不是夹具坏了,会诱 人 去弱化一条本来正常的门禁(实测:plugin-auth → core;plugin-email → platform-objects 则是消融后 375 试假绿、重建后 4 红)。每一腿(mutate 与 restore)都是:改动 →pnpm --filter <pkg> build→ 证明它到达了dist/→ 才 读运行结果:node scripts/ablation-dist-preflight.mjs <pkg> '<marker>'只在被消费 的dist/真带着该状态时才退 0(消融删除守卫、以及每个 restore 腿,用--absent)。⛔ restore 腿最常被跳过 —— 留在dist/里的 marker 会让突变代码对该 树之后的每次运行保持生效,后面的测量量的是错的树。 -
dist/已 gitignore —— 安全;永不提交构建产物。 -
/_consoleUI 是 vendored objectui 构建,与框架dist是两回事。 它由.objectui-sha钉住、按预构建 bundle 提供。已合并的 objectui 修复 —— 甚至 bump 过的.objectui-sha—— 在 vendored console 重建之前不会活在 :3000 上:运行中的服务器继续提供旧构建产物(BUILD 陈旧 ≠ PIN 陈旧)。所以在宣布 :3000/_console 上发现 console/Studio UI 缺陷之前,先对当前 objectui 源码或全新 构建核一遍 —— vendored bundle 可能是旧的,缺陷可能上游已修。最快的权威核验 = objectui 的 HMR console 指向你的服务器:VITE_SERVER_URL=http://localhost:<port> DEV_PROXY_TARGET=http://localhost:<port> pnpm --filter @object-ui/console dev(独立 origin → 需要它自己的[email protected]/admin123登录)。跳过这步曾在 一个 objectui main 已修掉的 action-create 死路上白付一整圈 spawn-a-fix。 - 漂移的构建不再静默启动(#7752)。
build-console.sh把它构建所用的 SHA 盖 进packages/console/dist/.objectui-sha;当这个章与仓库的.objectui-shapin 不一致时,os dev拒绝挂载/_console并打印补救 ——/_console/404,横 幅不再宣传 console URL。那是要修的前置条件,不是产品缺陷:跑pnpm objectui:build(在钉住的 SHA 上重建 ——objectui:refresh会把 pin 重新 bump 到你本地../objectui的 HEAD)再重启。pnpm check:console-sha不启动也能报同一比较。OS_ALLOW_CONSOLE_DRIFT=1是故意启动陈旧 bundle —— 那之 后你做的每个 console 观察,描述的都是一个仓库没有钉住的 commit。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 158 lines · 128 tokens per session scan A a51a4e640527
dogfood-verification is a skill published in the GitHub repository objectstack-ai/objectstack (45 stars, last pushed yesterday), licensed Apache-2.0. It adds 128 tokens to every session and 3,290 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ontotect
Systematic ontology engineering for designing, constructing, reviewing, repairing, optimizing, refactoring, validating, documenting, and governing ontologies, vocabularies, taxonomies, knowledge graphs, semantic models, and mappings. Use for RDF/RDFS, OWL 2, SKOS, SHACL, SPARQL, OBO, Turtle, JSON-LD, RDF/XML…
mykg
Run mykg knowledge-graph commands inside Claude Code from one slash command /mykg. The user describes intent in natural language (extract, append, resume, approve, walkthrough, parse-docs, fetch-web, query); the skill parses intent, builds the right mykg CLI command from the live --help output, confirms, runs it, and…
mykg-github-pages
Set up and maintain the GitHub Pages site for the mykg repo (SenolIsci/mykg) — a purpose-built pages/ folder (landing page adapted from README.md, blog posts, diagrams), built by a GitHub Actions workflow that runs Jekyll and deploys the result to a gh-pages branch. Use whenever the user wants to publish project…
networkx
Build, analyze, and visualize networks and graphs using NetworkX (Python). Use this skill whenever the user wants to: create graphs or networks, analyze graph properties, compute centrality measures, find shortest paths, detect communities, run graph algorithms, convert graphs to/from matrices or dataframes, visualize…
design-audit
Audit a finished frontend change by measuring rendered rects and computed styles before using screenshots as human-checkable evidence.
map-perf
Measure topology-map drag, pan, and zoom with a deterministic harness that proves it grabbed a real node instead of silently panning the background.