Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xcodethink/open-claude-code-skills --skill 22git clone --depth 1 https://github.com/xcodethink/open-claude-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xcodethink/open-claude-code-skills/22)<a href="https://agentmods.dev/skills/xcodethink/open-claude-code-skills/22"><img src="https://agentmods.dev/badge/skills/xcodethink/open-claude-code-skills/22/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xcodethink/open-claude-code-skills/22"><img src="https://agentmods.dev/badge/skills/xcodethink/open-claude-code-skills/22.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00234 | $0.01553 |
| Opus 5.5 | $0.00094 | $0.00621 |
| Sonnet 5.5 | $0.00047 | $0.00311 |
| Haiku 4.5 | $0.00023 | $0.00155 |
Grade A, and why
22-质量门禁体系 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
22-质量门禁体系 (Quality Gate System)
对标: Google SRE Error Budget + Stripe Financial-Grade Engineering + Microsoft SDL + TikTok Hyperscale Reliability + 金融机构 SOX/ITGC
定位: 不重复已有 skills 的内容，作为跨 skill 编排层 — 定义"达标线"、"决策点"、"节奏"，引用已有 skills 执行具体动作。
核心理念 (行业共识)
五家顶级机构殊途同归的 6 条共识:
- 量化阈值 — 不说"够好了"，说具体数字 (Google SLO / Stripe bug bar / Microsoft quality gate)
- 门禁有后果 — 不达标就冻结发布，不是"建议" (Google error budget freeze / Microsoft FSR block)
- 分离构建者和验证者 — 自己写的代码不能自己签核通过 (金融 SoD / Google PRR / Microsoft FSR)
- 用真实场景测试 — 不只是单元测试，要 CUJ、影子测试、对账 (Google CUJ / TikTok shadow testing / 金融 reconciliation)
- 周期性复查 — 不只是发布前查，持续周/月/季/年节奏 (金融 SOX cadence / Google SLO review)
- 自动化执行 — 人的纪律会疲劳，编码进 pipeline (Stripe CI / TikTok automated gray release)
适配原则 (Solo/小团队)
- 不搞 CAB 会议 — 用结构化自审 checklist + 自动化门禁代替
- 不搞 SoD 分离部署 — 用 CI 自动门禁 + 强制 checklist 签核代替人员分离
- 渐进采用 — 新项目先 Module 1+3 (基线 + RRG)，成熟后加 Error Budget 和巡检
模块架构
22-质量门禁体系/
SKILL.md # 本文件: 总纲
01-质量基线和阈值.md # 量化标准 (所有项目的底线)
02-关键用户旅程(CUJ).md # 用户视角质量锚点
03-发布准备就绪门禁(RRG).md # Go/No-Go 决策流程
04-渐进发布和自动回滚.md # 灰度 + 自动回滚
05-Error-Budget和冻结机制.md # 错误预算 + 冻结策略
06-定期巡检节奏.md # 周/月/季/半年/年巡检
与已有 Skills 的关系 (编排，不重复)
| 本 skill 模块 | 引用的已有 skill | 关系 |
|---|---|---|
| 01-质量基线 | 07-测试规范、01-通用要求 | 本模块定义"达标数字"，07/01 定义"怎么测" |
| 02-CUJ | 13-系统体检和审计 | 本模块定义 CUJ 清单，13 执行真人路径测试 |
| 03-RRG | 07+04+12+13 全部 | 本模块是发布前的总检查点，调用各 skill 的输出 |
| 04-渐进发布 | 06-部署和运维 | 本模块定义灰度策略，06 执行具体部署动作 |
| 05-Error Budget | 12-系统监控和告警 | 本模块定义 budget 规则，12 提供监控数据 |
| 06-定期巡检 | 04+06+07+12+13+14 | 本模块定义节奏，各 skill 提供检查内容 |
| (海拔正交) | 23-跨对话执行纪律 | 22 是发版门禁层 (Go/No-Go); 23 是跨对话执行层 (项目跨 N 对话不跑偏)。22 的 RRG 可作为 23 某 session DoD 的验收门; 两者正交, 冲突时严的赢 |
触发规则
自动触发
- 任何生产部署前 → 必须过 Module 3 (RRG) 的 Go/No-Go checklist
- 项目新建时 → 定义 Module 1 (基线) + Module 2 (CUJ)
- 生产事故后 → 检查 Module 5 (Error Budget) 消耗情况
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 77 lines · 234 tokens per session scan A afb2b5f5d8cc
22-质量门禁体系 is a skill published in the GitHub repository xcodethink/open-claude-code-skills (2 stars, last pushed 2mo ago), licensed MIT. It adds 234 tokens to every session and 1,553 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
playwright-testing
E2E testing with Playwright - Page Objects, cross-browser, CI/CD.
github-actions
Use when authoring or fixing GitHub Actions CI/CD — workflows under .github/workflows, triggers, job matrix, caching, token permissions, OIDC cloud deploys, environment gates, reusable workflows. NOT the Dockerfile or image build strategy (that is docker), NOT the branching model (that is git-workflow), NOT release…
vue-idioms
Vue 3 Composition API patterns: syntax, reactive state with Pinia stores, reusable composables, and Vitest component testing. Use when developing or refactoring Vue 3 frontend applications.
browser-automation
Playwright browser automation via MCP. Covers E2E testing, UI review, web scraping, screenshot capture, and general browser interaction. MCP-first — CLI is fallback only.
python-idioms
Modern Python (3.11+) idioms: type annotations, typing Protocols, Pydantic models, asyncio, pytest fixtures, and Ruff/Mypy strict compliance. Use when writing, refactoring, or reviewing Python applications, APIs, or scripts.
ci-cd
CI/CD pipeline architecture: GitHub Actions, GitLab CI, multi-stage Dockerfiles, vulnerability scanning, SBOM attestation, and deployment promotion. Use when designing, creating, or debugging pipelines, container builds, or release workflows.