Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/peiiii/nextclaw/development-validationnpx skills add Peiiii/nextclaw --skill development-validationgit clone --depth 1 https://github.com/Peiiii/nextclawWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.01223 |
| Opus 5 | $0.00028 | $0.00611 |
| Sonnet 5 | $0.00011 | $0.00245 |
| Haiku 4.5 | $0.00006 | $0.00122 |
Grade A, and why
development-validation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Development Validation
目标
验证真实风险，不追求命令数量。每个风险优先选择一份最有证明力的证据；新增验证只有在能排除不同失败类型时才成立。
风险分级
L0：文档与元信息
- 只做链接、标题、格式、结构或 diff 检查。
- build、lint、tsc、单测和冒烟默认不适用，不逐项执行来证明“不适用”。
L1：局部低风险
- TypeScript/TSX 触达时运行最窄可覆盖改动的 tsc。
- 源码触达时运行一次 targeted ESLint；不先跑会被无关债务阻塞的全 package lint。
- 纯视觉修改证明目标页面能加载、目标样式已生效；审美偏好交给用户确认。未改变交互或数据语义时，不增加全链路冒烟或多张截图。
L2：局部行为与 bugfix
- 选择一份最贴近风险的定向测试。
- 再从真实用户路径、最近链路冒烟、assembled boundary test 中选择优先级最高且成本合理的一条功能证据。
- Task Understanding 选择
reproduce时，保留修前失败证据，并用同一入口和观察指标证明修后通过；昂贵端到端复现可以降到命中同一违约点的边界回放或定向失败测试。 - Task Understanding 选择
skip-reproduction时，核对其直接根因证据和预先声明的替代验证；只有替代证据能确定证明原合同恢复时才可通过，并披露没有修前失败基线。 - 验证中发现根因、失败边界或判定条件仍不确定时，原跳过决定失效，返回 Task Understanding 补复现，不在 Validation 内猜测成功。
L3：跨边界与高影响
- tsc、targeted lint 和相关定向测试必需。
- 增加 assembled boundary test 或真实链路冒烟；两者都跑时必须分别证明不同风险。
- 只有影响面确实扩大时才增加 package/full regression。
- HTTP/API/transport 变更应在组装后的真实边界断言精确 contract，不只检查状态码或方法被调用。
L4：发布与不可逆变更
读取发布与不可逆变更验证；涉及 runtime update 时同时读取Runtime Update 验证。
条件验证
- 分页/懒加载、虚拟列表瞬态、IME/选区、结构化输入、附件消费闭环或外部主题复刻：读取复杂 UI 验证。普通 CSS 和审美修改不读取。
- 用户已在真实实例复现，或任务触达冷/热启动、重复状态转换、journal/projection/hydrate、accepted run handle 或启动恢复：读取真实运行实例验证。
- 需要隔离全局安装版验证当前仓库源码：读取本地源码运行验证。
- 验证
packages/extensions/*未发布源码：读取本地 Extension 源码验证。 - 对指定 session/model 执行真实 NCP chat：读取NCP Chat 冒烟。
一次只选择当前风险需要的环境参考。
执行节奏
- 调查和实现阶段只跑能指导下一步的最快定向检查；实现稳定后统一执行一次收尾验证。
- 相关实现未变化时，不重复运行已经通过的同一验证。
- 目标能力的实现或装配链路继续变化后，旧证据立即失效。
- TypeScript 源码、类型声明、导入导出或运行链路触达时，tsc 必跑，测试和 lint 不能替代。
- 源码、脚本、测试或运行链路配置触达时，targeted ESLint 默认必跑；package lint 只在影响面或合同要求时追加。
lint:new-code:governance只在新增/移动/重命名文件、改变 owner/目录/跨包依赖、触达治理敏感规则或提交前运行。check:governance-backlog-ratchet只在治理规则、baseline、相关脚本变化或提交/发布闭环时运行。- 长日志只保留结论、失败切片和 artifact 路径。
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 72 lines · 57 tokens per session scan A 0cef8906e9c6
development-validation is a skill published in the GitHub repository Peiiii/nextclaw (253 stars, last pushed 2d ago), licensed MIT. It adds 57 tokens to every session and 1,223 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ha-mac-control
Hope Agent native macOS desktop control — the standard maccontrol status / diagnostics / apps / dock / spaces / snapshot / visual / windows / menu / clipboard / dialog loop, target-first action rules, no-blind-coordinate policy, and recovery for stale AX/window/menu/dialog state. Load whenever using maccontrol, or…
ha-skill-creator
Create, edit, improve, or audit Hope Agent skills. Use when the user wants to: (1) create a new skill from scratch, (2) edit or improve an existing skill, (3) review or clean up a SKILL.md file, (4) run evaluations to test skill effectiveness, (5) optimize skill descriptions for better trigger accuracy. Trigger…
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
ha-logs
Self-service diagnostics — query Hope Agent's local SQLite databases (logs / sessions / background jobs) directly via the exec tool to investigate problems, analyze usage, and locate root causes. Trigger on: user reports something broken / failing / slow / stuck / not responding ('X 不工作', 'X 报错', 'X 卡住', '为什么 X 失败'…
ha-pet-import
Safely import, select, switch, or enable a compatible desktop pet in Hope Agent. Resolve packages from any origin, including local folders, zip archives, pet.json plus a sprite, PNG/WebP atlases, chat attachments, repository or cloud files, direct HTTPS artifact URLs, and download pages. Use whenever a user asks to…
feishu
Use when the user mentions 飞书 / Feishu / Lark workspace operations: docx (云文档) read/write, bitable (多维表格) records / views / dashboards, drive (云盘) upload/download, wiki (知识库) link resolution, approval (审批) instance create/cancel/query, calendar (日历) event create/list/update + attendees, contact (联系人) user/department…