Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pangon/ai-sdlc-framework/sdlc-execute-tasknpx skills add pangon/ai-sdlc-framework --skill sdlc-execute-taskgit clone --depth 1 https://github.com/pangon/ai-sdlc-frameworkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pangon/ai-sdlc-framework/sdlc-execute-task)<a href="https://agentmods.dev/skills/pangon/ai-sdlc-framework/sdlc-execute-task"><img src="https://agentmods.dev/badge/skills/pangon/ai-sdlc-framework/sdlc-execute-task.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00067 | $0.07333 |
| Opus 5 | $0.00034 | $0.03667 |
| Sonnet 5 | $0.00013 | $0.01467 |
| Haiku 4.5 | $0.00007 | $0.00733 |
Grade B, and why
SDLC-execute-task scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **External tool and library dependencies**: when a task requires tools or libraries that are not available in the current environment (system packages like ffmpeg, database engines, runtime tools, etc.), **always notif How it starts
The opening of the file, as written. The whole thing — 314 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Instructions
You are executing a development task from the implementation plan. You will identify the task, derive its actual scope from the authoritative sources (requirements, design documents, decisions), implement it (or decompose it if too large), and update the task tracker.
Invocation Modes
This skill has two invocation modes, determined by whether the user provided context or instructions alongside the skill invocation:
- Bare invocation — the skill was invoked with no additional context, arguments, or instructions (e.g., just
/SDLC-execute-taskon its own). In this mode, the skill automatically selects the next pending task from the implementation plan following the rules in "Task Selection — Bare Invocation" below. - Contextual invocation — the skill was invoked together with context or instructions (a specific task ID, a natural-language description of which task to work on, scoping hints like "the auth task in phase 2", or any other directive narrowing the target). In this mode, the skill uses that context to identify which task to execute, following the rules in "Task Selection — Contextual Invocation" below. The user's context takes precedence: do not silently fall back to selecting the next task if the context is ambiguous — ask the user to clarify instead.
Determine the mode before doing anything else, and follow the corresponding Task Selection branch.
Task Descriptions Are Indicative, Not Prescriptive
The Task column in tasks.md contains a brief, indicative description — a shorthand hint of what the task is about. It is not a specification and must not be followed literally when doing so would conflict with the authoritative sources or the project's goals.
The authoritative sources for what a task must deliver are, in order of precedence:
- Requirements (linked in the
Reqcolumn) — the acceptance criteria define what "done" means. - Design documents (
2-design/) — the architecture, data model, and API design define how the system is structured. - Applicable decisions (
DEC-*files) — recorded patterns and constraints that must be respected. - SDLC system instructions (
CLAUDE.md, phase-specificCLAUDE.*.mdfiles) — project-wide rules and conventions. - Phase capabilities (the "Capabilities delivered" section in the Execution Plan) — what the current phase is supposed to make possible.
- Downstream task needs (tasks that list this task in their
Dependenciescolumn) — what other tasks will need from the output of this one.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 314 lines · 67 tokens per session scan B 2a883dc3e780
SDLC-execute-task is a skill published in the GitHub repository pangon/ai-sdlc-framework (124 stars, last pushed 10d ago), licensed Apache-2.0. It adds 67 tokens to every session and 7,333 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.
chat-perf
Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…