Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pingfanfan/hello-dsh --skill explain-codebasegit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/explain-codebase)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/explain-codebase"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/explain-codebase/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/explain-codebase"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/explain-codebase.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00894 |
| Opus 5.5 | $0.00025 | $0.00358 |
| Sonnet 5.5 | $0.00013 | $0.00179 |
| Haiku 4.5 | $0.00006 | $0.00089 |
Grade A, and why
explain-codebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
讲清楚一个陌生项目
目标是让对方能动手改，不是让对方知道有哪些目录。
判断标准很具体：讲完之后，对方应该能回答"我要加一个功能 X，应该改哪里"。做不到就是没讲清楚。
顺序
不要按目录顺序讲。 目录结构是最没有信息量的东西，而且它是结论不是起点。
按这个顺序：
一、这个项目解决什么问题
一到两句话。从 README、package.json 的 description、或最主要的对外接口推断。
如果读完 README 还说不清它解决什么问题，直接说出来——这本身是关于这个项目的重要信息。
二、入口在哪
- 可执行程序：
package.json的bin/main，Dockerfile的CMD，main()函数 - 库：
exports字段、index文件里导出了什么 - 服务：路由注册在哪、监听哪个端口
- 前端：挂载点、路由表
入口是所有理解的锚点。 找不到入口就不要往下讲。
三、一条完整的数据流
挑一个最典型的操作，从入口跟到底，把中间经过的每一层点出来。
比如"用户提交表单之后发生什么"：接口层 → 校验 → 业务逻辑 → 持久化 → 返回。
一条真实的路径胜过十个抽象概念。讲完这一条，大部分其他路径能自己推断。
四、关键抽象
只讲真正承重的那几个。判断标准：
- 被大量引用（改它会影响很多地方）
- 定义了扩展方式（新功能按什么模式加进来）
- 承载核心状态（数据存在哪、谁能改）
一个项目通常只有 3-5 个这样的抽象。超过 8 个就是没有筛选。
五、边界与外部依赖
- 依赖哪些外部服务（数据库、API、消息队列）
- 哪些是可替换的，哪些是硬绑定的
- 配置从哪来，有哪些必需项
怎么找这些信息
按性价比排序：
- README + 架构文档 —— 有就先读，但要验证是否过期
- 入口文件 —— 从这里往下追
- 目录名 + 文件名 —— 命名通常比注释诚实
- 测试 —— 测试是最准确的用法文档，尤其是集成测试
- package.json / 依赖清单 —— 看用了什么框架，能推断出大量约定
- git log —— 最近改动集中在哪，说明活跃区域在哪
不要通读所有文件。 大项目做不到，小项目没必要。
输出形式
- 先给一段总览，再展开
- 涉及具体位置时给出文件路径，能给行号更好
- 用一张简单的流向图说明主路径，不要画完整依赖图
- 明确区分"我确认的"和"我推测的"——推测的部分要标出来
不要做的事
- 不要逐个目录解释——那是文件浏览器的工作
- 不要复述代码逻辑——要讲设计意图和数据流
- 不要把所有类都列出来
- 不要在没读入口的情况下从中间某个文件开始讲
- 不要假装看懂了——看不懂的部分明说，比编一个说法有用得多
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 84 lines · 63 tokens per session scan A dbf0fc2be66b
explain-codebase is a skill published in the GitHub repository pingfanfan/hello-dsh (100 stars, last pushed 1mo ago), licensed MIT. It adds 63 tokens to every session and 894 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
skill
Ten native DSH tools give a text-only agent eyes. Use these structured tools directly; do not shell out to the bundled Python scripts or reproduce their implementation. Vision API credentials and model settings are managed by the plugin, so tool calls do not receive credentials.
modsearch
Plug-in web search, X (Twitter) search, and page fetch for models without native web access. Use whenever the task needs current information, external facts, source links, posts from X, or the content of a specific URL, and the active model/harness has no native search or fetch tool. Runs the modsearch CLI to return…
submit-dsh-plugin
A submission checklist and workflow for adding a DeepSeek Harness plugin to the community’s public catalogue. It prepares the catalogue entry and checks the plugin’s repository, metadata, tests, and required files.
manage-taskboard
Manage work in the native DeepSeek Harness Taskboard with exact task ids and optimistic versions. Use when an Agent must inspect project work, claim an eligible todo, record progress or blockers, verify an implementation, submit it for human review, or release its own claim; also use when a human asks how to accept…
industry-research-method
A Chinese-language method for researching an industry by mapping its supply chain, tracking policies and news, and writing sourced reports. It separates the chain into upstream inputs, midstream production, and downstream distribution or use.