Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ryanzhao1011/workframe/module-initnpx skills add ryanzhao1011/workframe --skill module-initgit clone --depth 1 https://github.com/ryanzhao1011/workframeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00090 | $0.05233 |
| Opus 5 | $0.00045 | $0.02617 |
| Sonnet 5 | $0.00018 | $0.01047 |
| Haiku 4.5 | $0.00009 | $0.00523 |
Grade B, and why
module-init scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
python "$(cat .claude/workframe-state/plugin-root.txt)/scripts/module_init.py" --project "<项目根>" --params "<tree.json>" How it starts
The opening of the file, as written. The whole thing — 241 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Module Init Skill
前置依赖
调用本 skill 前需读 skill: document-norms §1(归属矩阵)/ §2(frontmatter 字段)/ §3(三段制 overview + HTML 注释边界)/ §4(索引层级与同步)。
定位
modules/ 体系下三类骨架的唯一创建入口:
- 基础模块(basic-module)= 领域级,10-20 个上限
- 子模块(sub-module)= 功能级,按需扩展
- 需求资产包(requirement)=
<sub>/requirements/<req_slug>/含 meta.yaml + overview.md + 默认子需求main/(可改名)
适用范围:已接入 Workframe 的项目(modules/ 体系默认启用)。
不适用:
- 修改/重命名已有模块 → 直接 Edit + 调
module-index-refresh - 一次性大规模迁移 → 调
migrate-to-modules - 仅刷新索引段 → 调
module-index-refresh - 创建 ADR / 调研 / 草稿 → 直接 Write 到对应目录(不需要 module-init)
输入
| 模式 | 必需输入(向用户问一次的字段) | 可选输入 |
|---|---|---|
| 创建基础模块 | name | owner / domain_tags |
| 创建子模块 | parent_basic + name | owner / tech_stack / code_paths |
| 创建需求 | parent_basic + parent_sub + name | owner / sub_req_name(默认 main;用户可改名作为首个子需求目录) |
name 命名约定(单字段承担路径段名与展示名,权威定义见插件根 reference/module-architecture.md §5.1):
- 允许字符:英文 / 数字 / 短横线 / 下划线 / 中文。例:
profile/用户档案/avatar-cropper/编辑资料 - 3 条 OS 硬约束(避不开):
- 不能含路径分隔符
/\ - 不能含 Windows 禁字符
< > : " | ? * - 不能含空格(含中间空格——stale 索引按空白切分,带空格的名字会被截断)
- 不能含路径分隔符
- 推荐英文短词(跨语言团队 + GitHub Pages 静态化 URL 友好),但中文也允许(subprocess / hooks 已统一 utf-8 处理)
- 内部存储:
name直接填到 yaml schema 的name字段(无display_name/slug二字段)。模板里 basic-module / sub-module 用{{BASIC_NAME}}/{{SUB_NAME}}占位符,需求资产包仍保留slug+title(不合并;{{REQ_SLUG}}+{{REQ_TITLE}}占位符不动;理由见 module-architecture §5.2);子需求用{{SUB_REQ_SLUG}}占位符(取值约束同{{REQ_SLUG}},允许中文) - 二段式 module path(用于跨文档引用 / issues
module:/ board.yamlmodule:):两个name用/拼接,例profile/edit或用户档案/编辑资料
对话流总则(避免反复问 / 误判 / 工程师腔)
- 资产类型必须在第一步明确:调用入口(
/core:module-init后用户的自然语言意图,或参数携带)必须能解析出"创建基础模块 / 子模块 / 需求资产包"三选一。无法解析时只问这一个问题问清,不问其他字段直到资产类型定下来。一旦确定,不再二次确认。 - 前提校验(仅在 Step 1 用于决定是否拒绝调用):
.workframe-config.json存在即视为已接入,可继续- 不存在 → 拒绝并提示"当前目录不是 Workframe 项目,先用
/workframe-launcher:setup接入" - 不要看 CLAUDE.md 是否存在(接入已有项目时不保证生成 CLAUDE.md)
- 不校验
project_type取值——modules/ 体系对所有 Workframe 项目默认启用
- modules/ 体系开启检测(决定 Step 1 走"启用 + 建首个"还是"在已有体系下建"分支):
- 已开启:
projects/modules/overview.md存在 - 未开启:上述文件不存在
- 不要用
projects/specs/是否存在判断"老需求多 → 建议 migrate"——项目骨架(project_scaffold.py)默认会建空projects/specs/overview.md,这不是"有老需求"信号 - 正确判定"specs/ 含真需求":
projects/specs/下**/*.md与**/*.yaml文件总数 ≥ 2(即除overview.md之外还有 ≥1 文件)才提示 migrate 选项
- 已开启:
- 命名只问一次:用 §输入 的
name单字段询问(yaml 只有 name 一个名字字段)。直接用普通对话提问"这个模块叫什么名字?",不要用 AskUserQuestion 多选组件硬编码候选名(如 user/demo/content/auth)误导用户——除非候选基于本项目实际上下文(如 .workframe-config.jsonproject_name/ 已有模块的语义类比)合理推荐,否则一律开放输入 - 大白话:禁止在对话里出现
slug/display_name/正则 ^[a-z]...等术语(基础/子模块层无此二字段;需求层req_slug仅作为内部 frontmatter 引用契约存在,不必跟用户提)。规则失败时给具体反例(如"不能含/,输入foo/bar不允许"),不要贴正则 - 报告末尾不输出盲目警告:通过规则 2 的前提校验后,不要再在报告尾部提示"本项目可能不该启用 modules/"一类的话
- 询问 name 的文案分层(让 PM 一眼看到"现在该回什么",不被可选项淹没):
- 核心问题独占一行 + 视觉突出(粗体或 ❓ 起头):例
**这个子模块叫什么名字?** - 命名约束折叠到
>引用块的小字注释,不跟核心问题混段 - 智能默认前置(如果适用):例
父基础模块默认为 用户档案(当前唯一),让 PM 知道这一项不必管 - 可选项明确标注"可跳过 / 留空用默认",避免 PM 误以为必答
- 基础模块标准文案模板:
**这个基础模块叫什么名字?** > 英文 / 数字 / 短横线 / 下划线 / 中文都可(如 `profile` / `用户档案` / `avatar-cropper`);不能含 `/` `\` `< > : " | ? *` 与空格(含中间)。 可选(不答即用默认): - owner(默认 `pm`) - domain_tags(默认空) - 子模块标准文案模板(单基础模块时):
**这个子模块叫什么名字?** > 命名约束同基础模块(英文 / 数字 / 短横线 / 下划线 / 中文;不含 `/` `\` `< > : " | ? *`;不含空格)。 父基础模块默认为 `用户档案`(当前唯一),可不答。 可选(不答即用默认): - owner(默认 `pm`) - tech_stack / code_paths(留空我会跳过反向索引初始化,可后填) - 需求标准文案模板(注意:需求目录不表达版本,默认在
<req_slug>/下建一个子需求目录main/;不强问sub_req_name,事后想改名直接重命名目录即可):**这个需求叫什么名字?**(用作目录名 + 跨文档引用标识) > 命名约束同模块(英文 / 数字 / 短横线 / 下划线 / 中文;不含 `/` `\` `< > : " | ? *`;不含空格)。 > > **两个占位符都从这一个答案派生,不再单独问**:`{{REQ_SLUG}}` = 目录名(原样); > `{{REQ_TITLE}}` = 展示标题——**默认等于目录名**,仅当用户答的是英文 slug > (如 `avatar-cropper`)时才顺带问一句中文标题,中文名直接两处同值。 > 骨架里两个占位符都必须替换,留一个没换会在 PRD 标题里露出 `{{REQ_TITLE}}`。 可选(不答即用默认): - owner(默认 `pm`) - sub_req_name(默认 `main`;想给首个子需求另起名时填,例如 `phase-1`、`核心流程`;后续拆子需求直接新建即可,不必现在决定)
- 核心问题独占一行 + 视觉突出(粗体或 ❓ 起头):例
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 241 lines · 90 tokens per session scan B 2ff2790d8dd8
module-init is a skill published in the GitHub repository ryanzhao1011/workframe (4 stars, last pushed 15d ago), licensed MIT. It adds 90 tokens to every session and 5,233 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
check-understanding
Phase quiz for AI Engineering from Scratch. Trigger with "quiz me", "test phase", "check my understanding", "do I know phase 3", or /check-understanding .
find-your-level
Interactive quiz that maps your AI/ML knowledge to a starting point in the 260-lesson, 20-phase AI Engineering from Scratch curriculum. Trigger phrases: "where should I start", "find my level", "what do I know", "which phase", "assess my knowledge", "placement test", "skip ahead".
audit-agents-skills
Audit Claude Code agents, skills, and commands for quality and production readiness. Use when evaluating skill quality, checking production readiness scores, or comparing agents against best-practice templates.
eval-agents
Audit Claude Code agents defined in .claude/agents/ for description specificity, model tier appropriateness, tools scoping, and system prompt quality. Detects dispatch ambiguity between agents, flags over-permissive tool grants, and checks for human-in-the-loop patterns that break programmatic orchestration. Use when…
eval-hooks
Audit Claude Code hooks defined in settings.json files for validity, performance safety, and correctness. Resolves each command against the filesystem, checks exit-code strategy for blocking hooks, flags missing timeouts, and reviews interactive vs async patterns. Use when setting up hooks for the first time…
check-cache-bugs
Audit Claude Code setup for cache bugs (CC#40524): sentinel, --resume/--continue, attribution header + ArkNill B3/B4/B5.