Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ryanzhao1011/workframe/code-to-docnpx skills add ryanzhao1011/workframe --skill code-to-docgit clone --depth 1 https://github.com/ryanzhao1011/workframeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00111 | $0.04308 |
| Opus 5 | $0.00056 | $0.02154 |
| Sonnet 5 | $0.00022 | $0.00862 |
| Haiku 4.5 | $0.00011 | $0.00431 |
Grade B, and why
code-to-doc scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
python "$(cat .claude/workframe-state/plugin-root.txt)/scripts/check-stale-modules.py" \ How it starts
The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code to Doc Skill
前置依赖
调用本 skill 前需读 skill: document-norms §1（归属）/ §2（frontmatter，特别是 current-state 类）/ §5.3（current-state 正文 source path 行级 anchor 强约束）。
参考插件根 reference/module-architecture.md §4.1（current-state 双向闭环）/ §6.2（跨形态适配）。
定位
双向闭环的"代码 → 文档"半边。LLM 解析 code_paths 涉及的代码文件，输出结构化 current-state/，让 PM 不读代码也能理解架构、API、数据模型。
适用范围：
- 子模块已创建（
submodule.yaml存在）且code_paths已配置 - 代码可读（本仓 ∪ dev 已 paste 跨仓代码到 tmp 目录）
不适用：
- 子模块未创建 → 先调
module-init code_paths为空 → 先在submodule.yaml配置- 仅刷新 frontmatter
updated→ 不需要本 skill - 写 PRD / 测试用例 →
prd-writer/test-case-design
输入
| 模式 | 输入 |
|---|---|
| 单子模块（推荐） | 二段式 <basic>/<sub> |
| 多子模块批量 | 数组 [<basic1>/<sub1>, <basic2>/<sub2>, ...] |
| stale 触发 | 读 .claude/workframe-state/stale-modules.yaml，按列表处理 |
可选：dev_paste_path（代码在外部仓库时，dev 把跨仓代码导出到本地 tmp，本 skill 解析此路径）。
工作流
Step 1: 形态适配 + 路径解析
1.1 读项目配置
- 读
.workframe-config.json获取monorepo.workspaces（如有） - 读
project.config.json获取miniprogramRoot（如有） - 读
package.json推断框架（next / nuxt / nestjs / 等）
1.2 解析 code_paths 实际位置
按 tech_stack[].stack + 配置自动加正确根前缀：
| stack | 适配规则 |
|---|---|
wechat-miniprogram |
miniprogramRoot=miniprogram/ 时已包含前缀；./ 时需加 |
wechat-cloudfunction |
项目根直接（cloudfunctions/...） |
nextjs 单仓 |
项目根直接（app/... / pages/...） |
nextjs Monorepo |
检查 workspaces，如 apps/web/ 则补前缀 |
| 跨技术栈数组 | 按数组 path 字段逐条处理 |
报告：
解析 code_paths：
- miniprogram/pages/profile/edit/** → ./miniprogram/pages/profile/edit/ (12 个 .js + 3 个 .wxml)
- cloudfunctions/profile/get/** → ./cloudfunctions/profile/get/ (2 个 .js + 1 个 .json)
...
Step 2: 代码扫描
按 stack 类型采用不同解析策略：
| stack | 解析重点 |
|---|---|
wechat-miniprogram |
Page({}) / Component({}) 入口 + data / methods / lifetimes + usingComponents |
wechat-cloudfunction |
exports.main 入口 + event.action 路由 + cloud.database() 集合 |
nextjs (App Router) |
app/<route>/page.tsx / route.ts + Server Component 标记 + 中间件 |
nestjs |
@Controller / @Module / @Injectable 装饰器 + DTO + 数据库 entity |
express |
app.get/post/... 路由 + middleware + handler |
| 通用 | grep TODO / FIXME / HACK 标记 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 290 lines · 111 tokens per session scan B 5f025336f751
code-to-doc is a skill published in the GitHub repository ryanzhao1011/workframe (4 stars, last pushed 15d ago), licensed MIT. It adds 111 tokens to every session and 4,308 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
check-understanding
Phase quiz for AI Engineering from Scratch. Trigger with "quiz me", "test phase", "check my understanding", "do I know phase 3", or /check-understanding .
find-your-level
Interactive quiz that maps your AI/ML knowledge to a starting point in the 260-lesson, 20-phase AI Engineering from Scratch curriculum. Trigger phrases: "where should I start", "find my level", "what do I know", "which phase", "assess my knowledge", "placement test", "skip ahead".
audit-agents-skills
Audit Claude Code agents, skills, and commands for quality and production readiness. Use when evaluating skill quality, checking production readiness scores, or comparing agents against best-practice templates.
eval-agents
Audit Claude Code agents defined in .claude/agents/ for description specificity, model tier appropriateness, tools scoping, and system prompt quality. Detects dispatch ambiguity between agents, flags over-permissive tool grants, and checks for human-in-the-loop patterns that break programmatic orchestration. Use when…
eval-hooks
Audit Claude Code hooks defined in settings.json files for validity, performance safety, and correctness. Resolves each command against the filesystem, checks exit-code strategy for blocking hooks, flags missing timeouts, and reviews interactive vs async patterns. Use when setting up hooks for the first time…
check-cache-bugs
Audit Claude Code setup for cache bugs (CC#40524): sentinel, --resume/--continue, attribution header + ArkNill B3/B4/B5.