Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pingfanfan/hello-dsh/explain-codebasenpx skills add pingfanfan/hello-dsh --skill explain-codebasegit clone --depth 1 https://github.com/pingfanfan/hello-dshWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.00894 |
| Opus 5 | $0.00032 | $0.00447 |
| Sonnet 5 | $0.00013 | $0.00179 |
| Haiku 4.5 | $0.00006 | $0.00089 |
Grade A, and why
explain-codebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
讲清楚一个陌生项目
目标是让对方能动手改，不是让对方知道有哪些目录。
判断标准很具体：讲完之后，对方应该能回答"我要加一个功能 X，应该改哪里"。做不到就是没讲清楚。
顺序
不要按目录顺序讲。 目录结构是最没有信息量的东西，而且它是结论不是起点。
按这个顺序：
一、这个项目解决什么问题
一到两句话。从 README、package.json 的 description、或最主要的对外接口推断。
如果读完 README 还说不清它解决什么问题，直接说出来——这本身是关于这个项目的重要信息。
二、入口在哪
- 可执行程序：
package.json的bin/main，Dockerfile的CMD，main()函数 - 库：
exports字段、index文件里导出了什么 - 服务：路由注册在哪、监听哪个端口
- 前端：挂载点、路由表
入口是所有理解的锚点。 找不到入口就不要往下讲。
三、一条完整的数据流
挑一个最典型的操作，从入口跟到底，把中间经过的每一层点出来。
比如"用户提交表单之后发生什么"：接口层 → 校验 → 业务逻辑 → 持久化 → 返回。
一条真实的路径胜过十个抽象概念。讲完这一条，大部分其他路径能自己推断。
四、关键抽象
只讲真正承重的那几个。判断标准：
- 被大量引用（改它会影响很多地方）
- 定义了扩展方式（新功能按什么模式加进来）
- 承载核心状态（数据存在哪、谁能改）
一个项目通常只有 3-5 个这样的抽象。超过 8 个就是没有筛选。
五、边界与外部依赖
- 依赖哪些外部服务（数据库、API、消息队列）
- 哪些是可替换的，哪些是硬绑定的
- 配置从哪来，有哪些必需项
怎么找这些信息
按性价比排序：
- README + 架构文档 —— 有就先读，但要验证是否过期
- 入口文件 —— 从这里往下追
- 目录名 + 文件名 —— 命名通常比注释诚实
- 测试 —— 测试是最准确的用法文档，尤其是集成测试
- package.json / 依赖清单 —— 看用了什么框架，能推断出大量约定
- git log —— 最近改动集中在哪，说明活跃区域在哪
不要通读所有文件。 大项目做不到，小项目没必要。
输出形式
- 先给一段总览，再展开
- 涉及具体位置时给出文件路径，能给行号更好
- 用一张简单的流向图说明主路径，不要画完整依赖图
- 明确区分"我确认的"和"我推测的"——推测的部分要标出来
不要做的事
- 不要逐个目录解释——那是文件浏览器的工作
- 不要复述代码逻辑——要讲设计意图和数据流
- 不要把所有类都列出来
- 不要在没读入口的情况下从中间某个文件开始讲
- 不要假装看懂了——看不懂的部分明说，比编一个说法有用得多
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 84 lines · 63 tokens per session scan A dbf0fc2be66b
explain-codebase is a skill published in the GitHub repository pingfanfan/hello-dsh (86 stars, last pushed 18d ago), licensed MIT. It adds 63 tokens to every session and 894 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
wayfinder
把一个巨大的工作块(超过单个 agent 会话所能承载)规划为 issue tracker 上的一张共享决策 ticket 地图,并逐个解决这些 tickets,直到通往目的地的路线清晰可见。.
teach
在当前工作区内教会用户一项新技能或一个新概念。.
dsh-doc-standards
Use when writing, moving, reviewing, or auditing documentation in the deepseek-harness repo — choosing hierarchy and detail, separating tutorials from references, checking tutorial progression, trimming doc slop, responding to a verify-doc-budgets failure, or requests like "improve the docs", "audit the docs", "where…
teach
Teach the user a new skill or concept, within this workspace.
dsh-web-release
Release and publish the dsh-web monorepo (DSH Web GUI plugin family + skin collection) — bump all packages to one unified version, commit and tag (tags are cut from main after dev integration; dev is the integration branch), push the vX.Y.Z tag that triggers the GitHub Actions publish pipeline, and verify the npm…