Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ryanzhao1011/workframe --skill setupgit clone --depth 1 https://github.com/ryanzhao1011/workframeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ryanzhao1011/workframe/setup)<a href="https://agentmods.dev/skills/ryanzhao1011/workframe/setup"><img src="https://agentmods.dev/badge/skills/ryanzhao1011/workframe/setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ryanzhao1011/workframe/setup"><img src="https://agentmods.dev/badge/skills/ryanzhao1011/workframe/setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00175 | $0.18902 |
| Opus 5.5 | $0.00070 | $0.07561 |
| Sonnet 5.5 | $0.00035 | $0.03780 |
| Haiku 4.5 | $0.00017 | $0.01890 |
Grade A, and why
setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
r = subprocess.run([exe, "plugin", "marketplace", "list", "--json"], How it starts
The opening of the file, as written. The whole thing — 811 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Workframe 项目初始化
定位
Workframe 的唯一入口:在任意目录发起,创建新项目或接入存量项目,完成后由 core 插件接管项目内的日常工作。
本 skill 属用户级 workframe-launcher 插件,与项目级 core 插件分层:launcher 管「怎么开局」,core 管「项目里怎么干活」。
依赖方向(硬约束)
launcher 只能单向依赖 core,且只能通过 marketplace 注册信息定位 core。 两扇门各有自己的注册信息,所以定位器有两个:
CC 门: 读 ~/.claude/plugins/known_marketplaces.json → 取本市场 installLocation
Codex 门:读 codex plugin marketplace list --json → 取本市场 root
→ 拼 <installLocation 或 root>/plugins/core/...
不要去探测「我现在跑在哪扇门里」,按结果判:两个定位器按序各跑一次,谁解析得到用谁。
框架自己就是拒绝探测的——_harness.harness() 的判据是命令行 --harness(两份 hooks.json
各自传),它的 docstring 逐字写着探测法在嵌套启动时 CLAUDE_* 会泄漏进 Codex 的 hook 环境、
恒判成 CC;而本 skill 根本没有 hooks.json、没人给它传 --harness。
定位器跑不通(命令不存在 / 文件不在 / 解析失败)就是「这扇门没有」,不是错误,不要报错停下。
禁止用 ../ 一类相对路径向上找 core:插件安装时按插件逐个复制到缓存
(cache/<市场>/<插件>/<版本>/),launcher 的安装目录旁边不存在 core。
目录源(开发期)碰巧有兄弟目录,GitHub 源(用户侧)没有——该写法开发期能跑、发布后必坏。
定位脚本 A(CC 门的注册表)——每次执行前跑一次,一次拿到 CORE 根路径和市场源:
python - <<'PY'
import json, pathlib
km = json.loads((pathlib.Path.home()/".claude/plugins/known_marketplaces.json").read_text(encoding="utf-8"))
for name, meta in km.items():
loc = pathlib.Path(meta.get("installLocation", ""))
mf = loc/".claude-plugin"/"marketplace.json"
if not mf.exists():
continue
names = {p.get("name") for p in json.loads(mf.read_text(encoding="utf-8")).get("plugins", [])}
if not ({"core", "workframe-launcher"} <= names):
continue
src = meta.get("source") or {}
kind = src.get("source") or ("directory" if src.get("path") else "?")
origin = src.get("repo") or src.get("url") or src.get("path") or "?"
print(f"MARKET={name}\tCORE={loc/'plugins'/'core'}\tSOURCE={origin}\tKIND={kind}\tVIA=cc")
PY
定位脚本 B(Codex 门的注册表)——A 一条都没输出、或要核对是不是同一个市场时跑:
python - <<'PY'
import json, os, pathlib, shutil, subprocess
try:
# 必须先 which 出全路径:Windows 上 npm 装的是 codex.CMD,而 CreateProcess 不按
# PATHEXT 找——直接给 "codex" 会抛 FileNotFoundError,看起来就像「没装 codex」
exe = os.environ.get("WF_CODEX_EXE") or shutil.which("codex")
r = subprocess.run([exe, "plugin", "marketplace", "list", "--json"],
capture_output=True, text=True, encoding="utf-8", timeout=90)
rows = json.loads(r.stdout).get("marketplaces", []) if r.returncode == 0 else []
except Exception:
rows = [] # 没装 codex / 命令失败 ⇒ 这扇门没有,不是错误
cfg = {}
try:
import tomllib
home = pathlib.Path(os.environ.get("CODEX_HOME") or (pathlib.Path.home()/".codex"))
cfg = tomllib.loads((home/"config.toml").read_text(encoding="utf-8")).get("marketplaces", {})
except Exception:
pass
UNC = chr(92)*2 + "?" + chr(92) # Windows 扩展长度前缀,写成 chr() 免得被 shell 吃掉反斜杠
for row in rows:
root = pathlib.Path(row.get("root") or "")
mf = root/".claude-plugin"/"marketplace.json"
if not mf.exists():
continue
names = {p.get("name") for p in json.loads(mf.read_text(encoding="utf-8")).get("plugins", [])}
if not ({"core", "workframe-launcher"} <= names):
continue
name = row.get("name") or "?"
entry = cfg.get(name) or {}
origin = str(entry.get("source") or "?")
if origin.startswith(UNC):
origin = origin[len(UNC):]
st = entry.get("source_type") or "?"
print(f"MARKET={name}\tCORE={root/'plugins'/'core'}\tSOURCE={origin}\tKIND="
+ ("directory" if st == "local" else st) + "\tVIA=codex")
PY
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +205 lines · +87 tokens per session 7af3b3e158c2
- 1mo ago First seen · 606 lines · 88 tokens per session scan A 9e34c131646d
setup is a skill published in the GitHub repository ryanzhao1011/workframe (7 stars, last pushed 24d ago), licensed MIT. It adds 175 tokens to every session and 18,902 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
link-ticket-to-session
Link the current Claude Code session to a ticket (Linear, Jira, GitHub Issues, or GitHub Pull Requests) and cache its title/status in karma. Use when the user explicitly asks to link, attach, associate, or connect this session to a ticket, issue, or PR — e.g. "/link-ticket-to-session ABC-123", "link this session to…
write-prd
Write PRD — Product Requirements Documents with structured 8-section templates, user stories, acceptance criteria, and value proposition validation. Use when writing PRDs, defining product requirements, creating user stories with INVEST criteria, or building go/no-go decision frameworks.
issue-triage
3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.
plan-pipeline
Orchestrates the complete planning pipeline: product direction (ceo-review) -> architecture (eng-review) -> implementation plan (start) -> validation (validate) -> execution (execute). Run stages individually or let the orchestrator coordinate the full flow.
expo-eas-submit
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production…
vault-tasks
A set of rules for managing tasks as tagged checkbox lines inside Obsidian notes with the Tasks plugin. It covers labels, work types, priorities, dates, statuses, inbox capture, and weekly review.