Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xcodethink/open-claude-code-skills/13npx skills add xcodethink/open-claude-code-skills --skill 13git clone --depth 1 https://github.com/xcodethink/open-claude-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xcodethink/open-claude-code-skills/13)<a href="https://agentmods.dev/skills/xcodethink/open-claude-code-skills/13"><img src="https://agentmods.dev/badge/skills/xcodethink/open-claude-code-skills/13.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00269 | $0.04126 |
| Opus 5 | $0.00134 | $0.02063 |
| Sonnet 5 | $0.00054 | $0.00825 |
| Haiku 4.5 | $0.00027 | $0.00413 |
Grade A, and why
13-系统体检和审计 scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| **2** | 每项必须贴证据 | 没有命令输出/curl/SQL/文件:行号证据的 PASS 视为未执行 | How it starts
The opening of the file, as written. The whole thing — 231 lines — stays where its author put it; the contents beside it link to each section on GitHub.
系统体检和审计
核心目标：确保系统在真实用户手中能完整、流畅、安全地完成所有核心操作，产生真实收入。
功能开发一大堆但用户无法正常使用 = 零价值。这个技能专治"功能堆砌但不闭环"。
审计心法（对抗式 — 防"过早闭环"，最高优先）
实战教训：AI 反复宣布"做完了 / 没问题 / 可以收尾了"，但人换一个角度一问，又能挖出真 bug、 真质量提升（退款级 AI bug、catalog 级数据重复、性能 2x、监控盲点…）。根因 = 过早闭环： 覆盖了显而易见的维度（功能对不对、有没有报错）就宣布完成，没系统轮换到正交维度。
1. "完成"是待证伪的假设，不是结论。 听到/想说"OK 了 / 没问题了"→ 立刻反问"我从哪个维度还没看过？"。默认立场是"我还没找到问题"， 不是"没有问题"。这是本 skill 一切原则之上的元立场。
2. 换镜头穷举，不靠灵感。 6 大模块 + 下列正交镜头逐个过；一个镜头干净 ≠ 全部干净。常被"过早闭环"漏掉的镜头： 性能（测真延迟 + 比可选方案，别假设当前最优）/ 运维盲点（X 挂了谁告警？定时任务真在跑？）/ 资源增长（什么表/队列会无限膨胀，有保留期吗）/ 跨引用影响面（删改某资源谁按 id 引用它）/ 配置漂移（主/兄弟/各环境是否一致）/ 成本滥用（贵端点能被刷爆账单吗）。
3. 双向怀疑 — 连"审计输出本身"都要核验。（多 agent 时代关键，易被忽略） 既证伪"它坏了"（驳回 agent/Vision/自己的疑虑假阳性——无可复现真实证据不上报）， 也证伪"它没事"（驳回过早全清）。派出去的审计 agent 的发现，也必须用难伪造通道逐条复核， 不能盲信去改——否则就是"为非问题瞎改"（实战：审计 agent 把有可见文字的按钮误报成"缺 aria-label"，盲信会平白加一堆无用属性）。
4. loop-until-dry。 持续轮换镜头，直到连续 2 个镜头无新发现才可说"这一轮到头了"——且只能说"这些镜头我过完了、 当前干净"，禁止说"无任何可打磨/绝对没问题"（永远还有真人才能验的音质/手感、真实用户反馈、 未穷举的边缘 case）。
落地工具：agents/adversarial-auditor.md —— 只读对抗式审计员，
丢个目标（板块/系统/PR）自动按镜头轮换 + 难伪造核验 + loop-until-dry，产出"逐镜头结论 + 真问题 +
假阳性驳回 + 诚实边界"。subagent_type: adversarial-auditor 调用。
与下方"防跳过铁律 / 体检原则"的关系：那些是执行手段（贴证据、不自欺、Not In Scope…）， 本节是元心法（防过早闭环 + 双向怀疑）——心法管"何时敢说完成"，手段管"每一步怎么做扎实"。
触发场景
| 场景 | 执行范围 | 预计耗时 |
|---|---|---|
| 版本发布前 | 全量体检 (6 模块全跑) | 2-4 小时 |
| 功能更新后 | 更新后回归验证 + 相关闭环 | 30-60 分钟 |
| 定期巡检 (月度) | 全量体检 | 2-4 小时 |
| 用户报 bug | 真人路径测试 (定向) | 15-30 分钟 |
| 安全事件后 | 安全深度审计 | 1-2 小时 |
| 上线收费功能前 | 商业闭环审计 | 1-2 小时 |
六大模块
按需读取对应文档，不要一次全读：
| # | 模块 | 解决什么问题 | 文档 |
|---|---|---|---|
| 1 | 全链路体检清单 | 工程基线是否健康：typecheck、test、build、API 合约、数据一致性、部署完整性 | 全链路体检清单.md |
| 2 | 真人路径测试 | 真实用户能不能完成核心操作：注册、扫描、查看报告、付费、使用付费功能 | 真人路径测试.md |
| 3 | 商业闭环审计 | 收入链路是否通畅：注册→激活→付费→权益生效→续费→退款，每一步都不能断 | 商业闭环审计.md |
| 4 | 安全深度审计 | 是否有可被利用的漏洞：认证绕过、权限越界、注入、数据泄露、业务逻辑漏洞 | 安全深度审计.md |
| 5 | 更新后回归验证 | 新改动是否破坏了已有功能：变更影响分析 + 核心路径回归 + 性能基线对比 | 更新后回归验证.md |
| 6 | 体检报告模板 | 标准化输出，可追踪、可对比、可归档 | 体检报告模板.md |
| 7 | 问题修复标准流程 | 审计发现问题后的 11 步工程化修复流程：记录→调研→设计→审查→计划→确认→开发→验证→回归→部署→文档 | ~/.claude/skills/14-问题修复标准流程/（独立技能） |
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 231 lines · 269 tokens per session scan A 568e3ef2442c
13-系统体检和审计 is a skill published in the GitHub repository xcodethink/open-claude-code-skills (2 stars, last pushed 29d ago), licensed MIT. It adds 269 tokens to every session and 4,126 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mailagent
Temporary inboxes for agent signup QA — create disposable addresses, wait for verification email, extract OTP or magic links. Use when automating signup, login, or email verification without parsing HTML manually.
write-test-plan
Generate a QA/UAT test plan from product specifications and task definitions, covering acceptance testing, integration flows, and exploratory testing. Unit tests are out of scope (handled by write-unit-tests skill).
e2e-check
Run E2E tests or interactive browser verification. Triggers on: 'run e2e', 'e2e test', 'browser test', 'check in browser', 'verify UI', 'interactive test'.
browser-testing
Tests a real web user flow with a browser by asserting semantic behavior, network and loading states, keyboard access, responsive layouts, and stable visual evidence. Use for browser bugs, end-to-end UI behavior, responsive or accessibility checks, and screenshot baselines. Not for static source review without a…
qa
Use to verify that code works correctly — browser-based testing with Playwright, native app testing with computer use, CLI testing, API testing, or root-cause debugging. Supports --quick, --standard, --thorough modes. Triggers on /qa.
pdlc-quality
Skill "pdlc-quality" from kanfu-panda/pdlc-skills, covering 质量闸门与报告, 这个命令的立身之本, 前置：两份真源, --init：首次建立目标声明 and 段一：跑真实 check.