Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add telagod/code-abyss --skill cultivating-skillsgit clone --depth 1 https://github.com/telagod/code-abyssWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/telagod/code-abyss/cultivating-skills)<a href="https://agentmods.dev/skills/telagod/code-abyss/cultivating-skills"><img src="https://agentmods.dev/badge/skills/telagod/code-abyss/cultivating-skills.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.01267 |
| Opus 5 | $0.00035 | $0.00633 |
| Sonnet 5 | $0.00014 | $0.00253 |
| Haiku 4.5 | $0.00007 | $0.00127 |
Grade C, and why
cultivating-skills scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- safety-scan: ignore RM_RF_ROOT,CURL_PIPE_SH,PROMPT_INJECTION 本 skill 列举危险/注入模式作为反例，自身不执行 --> How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
炼制神通 · cultivating-skills
框架之外仍有道。重复三次即沉淀，沉淀必经安全脊柱，发布必走漏斗。
三种触发模式
| 模式 | 触发 | 入口 |
|---|---|---|
distill |
Agent 在会话中识别"魔尊已重复 N 次同类操作" | 主动提议→显式确认 |
create |
用户显式 /cultivate-skill <topic> |
脚手架交互 |
improve |
用户指现有 skill 不足 | diff + 增量补丁 |
三级沉淀漏斗
L0 本地私有 ~/.claude/skills/local/ → 不入路由、显式调用、不审
L1 项目私有 <repo>/.claude/skills/ → 入 git、团队共享、强 lint
L2 社区贡献 GitHub Issue/PR + safety_scan → 进入 upstream 候选池
默认 L0——魔尊主动升级，避免污染。每升一级，门槛递增。
何时使用
| 场景 | 使用 | 理由 |
|---|---|---|
| 同类操作 ≥ 3 次（手动构造的 prompt、命令链、修复模板） | ✅ distill | 边际收益最高 |
| 现有 skill 缺失关键场景 / 表述模糊 | ✅ improve | 直接打补丁 |
| 用户提出新工程化方法论 | ✅ create | 显式生成骨架 |
何时不使用
- ❌ 单次性脚本 / 一次性查询——沉淀价值低，徒增噪音
- ❌ 复制粘贴现有 skill 内容——用
aliases或 reference 链接即可 - ❌ 项目特定状态（API 端点、内部约定）——写进项目 CLAUDE.md
- ❌ 重复内容含 secret / 私密细节——永不沉淀
安全脊柱（默认拒绝）
新 skill 落盘前必须通过 safety_scan，命中任一项即阻断：
- frontmatter 合规：
namekebab-case 唯一、description≥ 40 字、user-invocable显式声明 - 工具最小权限：
allowed-tools默认仅Read；扩权（Bash/Write/Edit/WebFetch）必须有理由说明 - 无硬编码 secret（复用
analyzing-security规则集） - 无危险默认模板、无 prompt injection 反模式、scripts 单入口、引用文件存在
详细规则矩阵见 references/safety-review.md。
工作流速查
| 你想做的 | 走哪卷 |
|---|---|
| 从会话提炼新 skill | creation-workflow.md |
| 改进现有 skill 的某个场景 | improvement-workflow.md |
| 识别"该沉淀了"的信号 | distillation-patterns.md |
| 通过安全审查 | safety-review.md |
| 升级到项目内 / 提交到社区 | publishing-guide.md |
使用
# 脚手架：默认 L0 本地，可改 --tier project / community
node scripts/skill_forge.js init <slug> [--tier local|project|community]
# 本地校验（frontmatter + 引用 + 工具白名单）
node scripts/skill_forge.js lint <skill-dir>
# 安全扫描（落盘前必跑）
node scripts/skill_forge.js scan <skill-dir>
# 改进模式（生成 diff 草案）
node scripts/skill_forge.js improve <existing-skill-dir>
# 升级 tier
node scripts/skill_forge.js promote <skill-dir> --to project
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 97 lines · 70 tokens per session scan C 52fe056a2e76
cultivating-skills is a skill published in the GitHub repository telagod/code-abyss (239 stars, last pushed 1mo ago), licensed MIT. It adds 70 tokens to every session and 1,267 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
model-router
A model-selection workflow that assigns different coding tasks to different AI models based on their abilities, cost, and the task’s risk or complexity.
verification-loop
Evidence-before-assertions workflow. Use before claiming work is done, before release, and after any behavior change in scripts/skills/MCP.
kirby-debugging-and-tracing
Diagnoses Kirby rendering/runtime issues using MCP runtime rendering, dump traces, and template/snippet/controller indexes. Use when outputs are wrong, errors occur, or tracing execution paths is required.
kirby-headless-api
Exposes Kirby content to headless clients using the API, KQL, and JSON representations. Use when building API endpoints, KQL queries, or headless frontends.
kirby-ide-support
Improves IDE autocomplete and static analysis in Kirby projects with PHPDoc hints and Kirby IDE helper generation. Use when types are missing or IDE support is degraded.
kirby-panel-and-blueprints
Designs Kirby blueprints and Panel UI, including blueprint reuse/extends, programmable blueprints, and custom Panel fields/sections/areas. Use when changing the Panel experience or schema.