Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/u9401066/nsforge-mcp/code-refactornpx skills add u9401066/nsforge-mcp --skill code-refactorgit clone --depth 1 https://github.com/u9401066/nsforge-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.02401 |
| Opus 5 | $0.00025 | $0.01201 |
| Sonnet 5 | $0.00010 | $0.00480 |
| Haiku 4.5 | $0.00005 | $0.00240 |
Grade A, and why
code-refactor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
4 near-identical copies found in the catalogue:
- code-refactor — 100% identical, 10 lines differ
- code-refactor — 100% identical, 10 lines differ
- code-refactor — 100% identical, 0 lines differ
- code-refactor — 100% identical, 8 lines differ
How it starts
The opening of the file, as written. The whole thing — 352 lines — stays where its author put it; the contents beside it link to each section on GitHub.
程式碼重構技能
描述
主動偵測並執行程式碼重構,維持 DDD 架構和程式碼品質。
觸發條件
- 「重構這段程式碼」、「refactor」
- 「這個檔案太長了」
- 「模組化」、「拆分」
- 主動觸發:偵測到程式碼超過閾值時
核心原則
📜 依據憲法第 7.3 條「主動重構原則」
重構不是改天換地,而是持續的小步快跑
每次提交都應該比上次更乾淨
閾值設定
📏 長度閾值
| 類型 | 警告 | 強制重構 |
|---|---|---|
| 檔案 | > 200 行 | > 400 行 |
| 類別 | > 150 行 | > 300 行 |
| 函數 | > 30 行 | > 50 行 |
| 目錄檔案數 | > 10 個 | > 15 個 |
🔄 複雜度閾值
| 指標 | 警告 | 強制重構 |
|---|---|---|
| 圈複雜度 | > 10 | > 15 |
| 巢狀深度 | > 3 層 | > 4 層 |
| 參數數量 | > 4 個 | > 6 個 |
| 依賴數量 | > 5 個 | > 8 個 |
重構模式庫
1️⃣ Extract Method(提取方法)
觸發條件:函數過長、重複邏輯
# Before
def process_order(order):
# 驗證訂單 (10 行)
if not order.items:
raise ValueError("Empty order")
if order.total < 0:
raise ValueError("Invalid total")
# ... 更多驗證
# 計算價格 (15 行)
subtotal = sum(item.price * item.qty for item in order.items)
tax = subtotal * 0.05
total = subtotal + tax
# ... 更多計算
# 儲存訂單 (10 行)
# ...
# After
def process_order(order):
self._validate_order(order)
total = self._calculate_total(order)
self._save_order(order, total)
def _validate_order(self, order):
"""驗證訂單有效性"""
if not order.items:
raise ValueError("Empty order")
# ...
def _calculate_total(self, order) -> Decimal:
"""計算訂單總金額(含稅)"""
subtotal = sum(item.price * item.qty for item in order.items)
return subtotal * Decimal("1.05")
2️⃣ Extract Class(提取類別)
觸發條件:類別職責過多、超過 150 行
# Before: User 類別包含太多職責
class User:
def __init__(self, name, email, ...):
self.name = name
self.email = email
self.address_line1 = ...
self.address_line2 = ...
self.city = ...
self.postal_code = ...
def validate_email(self): ...
def format_address(self): ...
def calculate_shipping(self): ...
# After: 提取 Address 值物件
@dataclass(frozen=True)
class Address:
"""地址值物件"""
line1: str
line2: str | None
city: str
postal_code: str
def format(self) -> str:
return f"{self.line1}\n{self.city} {self.postal_code}"
class User:
def __init__(self, name: str, email: Email, address: Address):
self.name = name
self.email = email
self.address = address
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 352 lines · 0 tokens per session scan A 2e59a9518494
code-refactor is a skill published in the GitHub repository u9401066/nsforge-mcp (4 stars, last pushed 2d ago), licensed Apache-2.0. It adds 50 tokens to every session and 2,401 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
vera-language
Write programs in the Vera programming language. Use when asked to write, edit, debug, or review Vera code (.vera files). Vera is a statically typed, purely functional language with algebraic effects, mandatory contracts, and typed slot references (@T.n) instead of variable names.
fizz-spec
Write, edit, or review FizzBee (.fizz) specifications for model checking distributed systems. Use when the user asks to model a system, write a formal spec, define invariants or liveness properties, or when working with a .fizz file.
fizz-check
Run the FizzBee model checker or simulator on a .fizz spec. Use when the user wants to verify a spec, run the model checker, simulate behavior, check a guided trace, or interpret model checker output.
fizz-mbt
Create model-based tests (MBT) connecting a FizzBee spec to a real system under test (SUT). Use when the user has a .fizz spec and wants to generate and run tests against a TypeScript/Playwright UI, Go service, Rust library, or Java application. Also use when working with fizzbee-mbt adapter code in any of these…
fizz-debug
Debug a FizzBee spec that fails, produces unexpected results, is too slow, or has an incorrect state space. Use when the model checker reports FAILED, a trace is incomplete, state counts are wrong, or the spec is timing out.
EMILIA Trust Verification
Verify the authenticity of AI-agent authorization receipts and human-device signoffs. Use this whenever a user shares a "trust receipt", an "authorization receipt", a "signoff", or WebAuthn/passkey approval evidence and asks whether it is valid, genuine, or tampered with. Pairs with the public EMILIA Protocol MCP…