Borrowing it
Nothing to install: this file belongs to zhinjs/zhin. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhinjs/zhin/main/.github/skills/zhin-plugin-refactoring/SKILL.mdgit clone --depth 1 https://github.com/zhinjs/zhinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhinjs/zhin/zhin-plugin-refactoring)<a href="https://agentmods.dev/skills/zhinjs/zhin/zhin-plugin-refactoring"><img src="https://agentmods.dev/badge/skills/zhinjs/zhin/zhin-plugin-refactoring.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.01902 |
| Opus 5 | $0.00040 | $0.00951 |
| Sonnet 5 | $0.00016 | $0.00380 |
| Haiku 4.5 | $0.00008 | $0.00190 |
Grade A, and why
zhin-plugin-refactoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Zhin 插件重构工作流
把已经存在但结构混乱的 Zhin 插件，整理成更清晰、更符合仓库约定的结构，同时尽量不改变现有行为。
配套参考按需加载：
何时使用
- 一个插件把命令、数据库、路由、页面逻辑都堆在一个文件里
- 需要拆分
commands/、services/、models/、client/ - 想减少重复逻辑、生命周期混乱、Context 使用散乱
- 想把旧插件迁移到更标准的 Zhin 插件结构
- 用户明确要求“重构插件”“整理插件结构”“拆模块但别改行为”
不适用场景
- 从零新建插件：改用
zhin-plugin-standard-development - 平台接入、Bot 生命周期、消息格式转换：改用适配器工作流
- 主要是页面视觉和交互优化：改用前端优化工作流
完成标准
- 行为保持不变或仅做用户明确允许的最小改动
- 目录和职责边界更清晰
- 生命周期和资源清理更稳定
- 配置、模型、Context、路由、页面入口不再散落在无关模块中
- 至少完成关键路径验证
重构步骤
第 1 步：冻结当前行为
先识别：
- 这个插件当前对外有哪些命令、路由、页面、事件或周期任务
- 哪些行为是用户可见的，不能随意改
- 哪些问题是结构问题，哪些是功能缺陷
不要一上来就拆文件。先把当前行为面画清楚。
第 2 步：盘点能力与职责
把现有代码按能力分类：
- 命令
- 中间件
- 事件监听
- 定时任务
- 组件
- AI 工具
- 数据模型
- 数据访问逻辑
- HTTP / Web 集成
- 配置声明
如果不知道怎么分类，先看 重构决策参考。
如果你需要一个“单文件旧插件如何拆成标准结构”的直观参考，直接看 重构前后对照示例。
第 3 步：确定目标结构
根据当前复杂度选择目标结构，而不是追求最完整目录：
- 小型插件：保留单文件，最多轻量抽服务
- 中型插件：拆
commands/、services/、models/ - 含控制台页面：再拆
client/ - 含 AI 工具：补
tools/
目标结构可直接参考 目标结构草图。
第 4 步：按稳定边界迁移
迁移优先顺序：
- 配置与 Schema
- 模型定义
- 数据访问与共享服务
- 命令与中间件
- 事件、定时任务、AI 工具
- Router 与 Web 页面入口
优先移动低耦合代码，再移动依赖较多的装配代码。
如果你不确定某段旧代码该落到哪个目录，先对照 重构前后对照示例 再迁移。
第 5 步：收口到入口文件
重构后的入口文件（plugin.ts）应只负责：
- default-export
definePlugin()（Plugin Runtime 形态；不要再用usePlugin()/MessageCommand） - 装配子模块与 Host 资源（
context.resources.has/use，如databaseHostToken/scheduleHostToken/httpHostToken） - 注册随 generation 回收的资源（
context.lifecycle.add(...)）
配置由 schema.json + context.config.get() 声明/读取（不再有 declareConfig()）；命令、中间件、AI 工具等能力放约定目录（commands/ / middlewares/ / agent/），由运行时按目录装配，不要在入口手写注册。不要把业务细节继续留在入口文件里。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 182 lines · 80 tokens per session scan A 2ff8155ec6d1
zhin-plugin-refactoring is a skill published in the GitHub repository zhinjs/zhin (135 stars, last pushed 2d ago), licensed MIT. It adds 80 tokens to every session and 1,902 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
contribute-to-eliza
Finish and prove a scoped elizaOS GitHub issue, or independently review and repair an open elizaOS pull request. Use when contributing compute to elizaOS by selecting unclaimed work, implementing or reviewing changes, adding real tests and evidence, validating artifacts, or preparing a contribution for maintainer…
ha-code-review
Hope-native review of uncommitted, staged, commit, branch, or PR changes: discover concrete regressions, independently verify candidates, and report actionable findings first without speculative noise.
Smart Code Review
Review a PR diff: triage its severity, then produce a depth-appropriate review with structured findings, fix suggestions, and a merge decision. Use for code review, review PR, and severity triage requests.
code-review
A code-review workflow that sends local changes to a separate reviewer for checks on correctness, style, performance, security, tests, and design.
requesting-code-review
Pre-commit verification pipeline — static security scan, baseline-aware quality gates, independent reviewer subagent, and auto-fix loop. Use after code changes and before committing, pushing, or opening a PR.
maf-anti-pattern-scanner
Scans a MAF 1.3.0 codebase for known anti-patterns AFTER migration is complete. Prefer the MCP tool MafScanAntiPatterns for one-shot scans; this skill is for understanding the rule taxonomy or contributing new anti-pattern rules. Detects insecure credential usage (DefaultAzureCredential, hard-coded keys), unsafe…