Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xcodethink/open-claude-code-skills/22npx skills add xcodethink/open-claude-code-skills --skill 22git clone --depth 1 https://github.com/xcodethink/open-claude-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xcodethink/open-claude-code-skills/22)<a href="https://agentmods.dev/skills/xcodethink/open-claude-code-skills/22"><img src="https://agentmods.dev/badge/skills/xcodethink/open-claude-code-skills/22.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00234 | $0.01553 |
| Opus 5 | $0.00117 | $0.00776 |
| Sonnet 5 | $0.00047 | $0.00311 |
| Haiku 4.5 | $0.00023 | $0.00155 |
Grade A, and why
22-质量门禁体系 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
22-质量门禁体系 (Quality Gate System)
对标: Google SRE Error Budget + Stripe Financial-Grade Engineering + Microsoft SDL + TikTok Hyperscale Reliability + 金融机构 SOX/ITGC
定位: 不重复已有 skills 的内容，作为跨 skill 编排层 — 定义"达标线"、"决策点"、"节奏"，引用已有 skills 执行具体动作。
核心理念 (行业共识)
五家顶级机构殊途同归的 6 条共识:
- 量化阈值 — 不说"够好了"，说具体数字 (Google SLO / Stripe bug bar / Microsoft quality gate)
- 门禁有后果 — 不达标就冻结发布，不是"建议" (Google error budget freeze / Microsoft FSR block)
- 分离构建者和验证者 — 自己写的代码不能自己签核通过 (金融 SoD / Google PRR / Microsoft FSR)
- 用真实场景测试 — 不只是单元测试，要 CUJ、影子测试、对账 (Google CUJ / TikTok shadow testing / 金融 reconciliation)
- 周期性复查 — 不只是发布前查，持续周/月/季/年节奏 (金融 SOX cadence / Google SLO review)
- 自动化执行 — 人的纪律会疲劳，编码进 pipeline (Stripe CI / TikTok automated gray release)
适配原则 (Solo/小团队)
- 不搞 CAB 会议 — 用结构化自审 checklist + 自动化门禁代替
- 不搞 SoD 分离部署 — 用 CI 自动门禁 + 强制 checklist 签核代替人员分离
- 渐进采用 — 新项目先 Module 1+3 (基线 + RRG)，成熟后加 Error Budget 和巡检
模块架构
22-质量门禁体系/
SKILL.md # 本文件: 总纲
01-质量基线和阈值.md # 量化标准 (所有项目的底线)
02-关键用户旅程(CUJ).md # 用户视角质量锚点
03-发布准备就绪门禁(RRG).md # Go/No-Go 决策流程
04-渐进发布和自动回滚.md # 灰度 + 自动回滚
05-Error-Budget和冻结机制.md # 错误预算 + 冻结策略
06-定期巡检节奏.md # 周/月/季/半年/年巡检
与已有 Skills 的关系 (编排，不重复)
| 本 skill 模块 | 引用的已有 skill | 关系 |
|---|---|---|
| 01-质量基线 | 07-测试规范、01-通用要求 | 本模块定义"达标数字"，07/01 定义"怎么测" |
| 02-CUJ | 13-系统体检和审计 | 本模块定义 CUJ 清单，13 执行真人路径测试 |
| 03-RRG | 07+04+12+13 全部 | 本模块是发布前的总检查点，调用各 skill 的输出 |
| 04-渐进发布 | 06-部署和运维 | 本模块定义灰度策略，06 执行具体部署动作 |
| 05-Error Budget | 12-系统监控和告警 | 本模块定义 budget 规则，12 提供监控数据 |
| 06-定期巡检 | 04+06+07+12+13+14 | 本模块定义节奏，各 skill 提供检查内容 |
| (海拔正交) | 23-跨对话执行纪律 | 22 是发版门禁层 (Go/No-Go); 23 是跨对话执行层 (项目跨 N 对话不跑偏)。22 的 RRG 可作为 23 某 session DoD 的验收门; 两者正交, 冲突时严的赢 |
触发规则
自动触发
- 任何生产部署前 → 必须过 Module 3 (RRG) 的 Go/No-Go checklist
- 项目新建时 → 定义 Module 1 (基线) + Module 2 (CUJ)
- 生产事故后 → 检查 Module 5 (Error Budget) 消耗情况
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 77 lines · 234 tokens per session scan A afb2b5f5d8cc
22-质量门禁体系 is a skill published in the GitHub repository xcodethink/open-claude-code-skills (2 stars, last pushed 29d ago), licensed MIT. It adds 234 tokens to every session and 1,553 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
continuous-llm-red-teaming-with-promptfoo
Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.
hooksmith
Use when designing or reviewing safe Grok Build hooks for linting, tests, formatting, notifications, command guards, lifecycle automation, or project hook trust decisions.
mlops-automation
Automate an MLOps project with mise tasks, lefthook hooks, Docker images, GitHub Actions, and MLflow tracking on a SQL backend. Use when adding a task runner, git hooks, CI/CD, or experiment tracking to a working package.
pdlc-ship
发布工作流（跑测试 → bump VERSION → 更 CHANGELOG → tag → 触发 CI/CD）.
factory-ci
CI and pull-request review conventions. One canonical .github/workflows/ci.yml is the merge gate (typecheck, lint, test, build, claude-review); branch protection's required-checks list matches the job list 1:1; anthropics/claude-code-action@v1 reviews every PR against the factory-pitfalls.md checklist as a required…
factory-deployment
Deployment and infrastructure conventions across builds. Vercel + Neon for web (with PR branch DBs), Cloud Run for Python services (one service per entry-point variant), GitHub Actions matrix-deploy on merge, Terraform with environments/modules layout for AWS / compliance customers, RDS IAM authentication for AWS DBs…