Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tencentcloud/octop/engineering-workflownpx skills add TencentCloud/Octop --skill engineering-workflowgit clone --depth 1 https://github.com/TencentCloud/OctopWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.00628 |
| Opus 5 | $0.00023 | $0.00314 |
| Sonnet 5 | $0.00009 | $0.00126 |
| Haiku 4.5 | $0.00005 | $0.00063 |
Grade A, and why
engineering-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
可靠工程工作流（执行细则）
当进入一个开发任务时，按下述顺序推进。每个阶段都要有"可验证的出口"，不要跳步。
阶段 1 — 探索（Brainstorming）
- 先回答：要解决什么问题？成功长什么样？边界与约束是什么？
- 不确定就向用户提问，不要假设。产出清晰的问题定义。
阶段 2 — 计划（Writing Plans）
多步骤任务先写书面计划：
目标：<一句话>
步骤：
1. <步骤> — 验收点：<如何确认完成>
2. ...
风险：<已知坑>
计划被确认后再写代码。小改动可省显式计划，但验证不能省。
阶段 3 — 测试驱动（TDD）
- 写一个会失败的测试，定义"完成"的边界。
- 写最小实现让测试变绿。
- 重构，保持测试绿。 禁止"先写一大堆实现再补测试"——那等于没有验收。
阶段 4 — 系统化调试（Systematic Debugging）
遇到失败：
- 复现：找到稳定复现的最小输入。
- 观察：用日志/断点/打印建立信号，定位出错层。
- 假设：提出 1–3 个可能根因。
- 实验：用最小改动逐一验证假设，排除。
- 修复：定位根因后再改，不靠猜。 禁止：盲目改代码碰运气、同一 prompt 无限重试。
阶段 5 — 代码审查（Requesting / Receiving）
- 合并前主动请求审查；自查清单：正确性、边界、错误处理、可维护性、测试覆盖。
- 收到审查意见：逐条理解并回应，不因"小"而忽略；要反驳也得给依据。
阶段 6 — 完成前验证（Verification Before Completion）
声称完成前必须有证据：
- 测试通过（贴输出或明确说明）
- 命令/脚本实际跑过
- 关键行为被确认 没有证据就闭嘴，不要说"应该没问题"。
收尾（Finishing a Development Branch）
功能完成 → 引导合并 / 提 PR / 清理分支。用约定式提交，中文 commit 清晰说明意图。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 53 lines · 47 tokens per session scan A 97f2dc663852
engineering-workflow is a skill published in the GitHub repository TencentCloud/Octop (1,292 stars, last pushed 3d ago), licensed MIT. It adds 47 tokens to every session and 628 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-driven-development
TDD: enforce RED-GREEN-REFACTOR, tests before code.
rust-testing
Rust testing patterns including unit tests, integration tests, async testing, property-based testing, mocking, and coverage. Follows TDD methodology.
feature-chain
Use when the user wants to build a new feature, implement a new capability, add functionality, or start a development task from scratch. Runs design Q&A → PRD → TDD → review automatically.
tdd
Use when the user wants to build a feature or fix a bug using test-driven development, or mentions red-green-refactor, TDD, or test-first development.
tdd
Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.
copilotkit-upgrade
Use when migrating a CopilotKit v1 application to v2 -- updating package imports, replacing deprecated hooks and components, switching from GraphQL runtime to AG-UI protocol runtime, and resolving breaking API changes.