Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zhpeng24/devkit/using-devkitnpx skills add zhpeng24/devkit --skill using-devkitgit clone --depth 1 https://github.com/zhpeng24/devkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.01412 |
| Opus 5 | $0.00018 | $0.00706 |
| Sonnet 5 | $0.00007 | $0.00282 |
| Haiku 4.5 | $0.00004 | $0.00141 |
Grade A, and why
using-devkit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Using Devkit
Devkit 的唯一入口：负责技能发现；遇到研发任务时，默认进入
sies-engineering。
Goal → Explore → Prototype → Evaluate → Refine → Engineer → Regress → Learn
L0–L3 只控制阶段深度、证据和持久化程度，不再维护另一套开发入口或固定工具流水线。
Development Start
- 读取用户原话、相关代码、仓库说明和已有 Issue/PR/ADR。
- 在仓库根目录查找
.devkit/project.json；存在时按references/project-profile.md读取项目参数。也可用DEVKIT_PROJECT_PROFILE指定显式路径。 - 检测语言、项目原生工具、Git/GitHub 能力和工作区状态。
- 按
references/level-decision.md判断 L0–L3。 - REQUIRED SUB-SKILL: 使用
sies-engineering建立或恢复研发状态。
项目参数提供路径、命令、环境和汇报默认值，不覆盖系统/用户指令、AGENTS.md 或安全
门禁，也不构成部署、生产访问或破坏性操作授权。项目参数无效或缺失时，回退到仓库原生
文档与工具；不要猜测。
用户已说“直接开始”“不用讨论”或给出等价授权时，告知判断后直接推进。不要重复询问 Issue、worktree、计划或评审方式；根据风险自动选择，并在交付时说明。
SIES Depth
| Level | Default depth | Persistence |
|---|---|---|
| L0 | 阶段内联；定位、修改、最小评价 | 无 Issue |
| L1 | 简短目标与证据契约；通常一个候选方案 | Issue 可选 |
| L2 | 显式目标、不确定性、评价和决定 | 默认 GitHub Issue |
| L3 | 完整探索、原型证据、风险策略与架构决定 | Issue + 重要决策 ADR |
模糊不等于复杂。范围、未知项、影响面和可逆性共同决定深度。
Adaptive Routing
| Current need | Skill or action |
|---|---|
| 产品目标或成功信号仍不清楚 | github-product-manager |
| 持久化 Goal、Experiment、Engineering 或 Learning | github-create-issue |
| 从已有 Issue 恢复和推进 | github-issue-workflow |
| 原因未知的 bug | 原因优先调试和最小复现实验 |
| Python 或其他语言实现 | 对应 friendly-*；不可用时用仓库原生工具 |
| 选择测试策略 | sies-engineering 的 Evidence Strategy |
| 产生可复用经验 | references/system-learning.md |
完整路由和传统 TDD 兼容规则见 references/orchestration-cheatsheet.md。
Evidence and Delivery
- GitHub 保存目标、证据和决定，不是必须按顺序打卡的流水线。
- Goal 或架构未稳定时先 Prototype/Evaluation，不把临时假设固化为回归测试。
- TDD 只有通过 SIES Test Strategy Gate 后才使用。
- 完整逻辑增量后运行目标测试；交付前统一执行一次风险匹配的回归。
- 测试通过但成功信号未满足，任务仍未完成。
- 本地 diff review 是默认；独立评审只用于高影响任务或用户明确要求。
- 只有重复、高影响或明确可复用的经验才建立 Learning Candidate。
Available Skills
| Skill | Use |
|---|---|
| sies-engineering | 默认目标优先、证据驱动研发序列 |
| friendly-python | Python 类型、格式、诊断和项目规范 |
| humanizing-writing | 中英文日常写作、技术文档和 PR 去 AI 味 |
| taste-skill | 上下文感知的网页设计与重设计 |
| image-to-code-skill | 从截图、Figma 或批准参考实现网页 |
| imagegen-frontend-web | 生成纯图片网站概念与分区参考 |
| imagegen-frontend-mobile | 生成移动端屏幕和流程概念图 |
| pptx | 创建、读取、编辑和验证 PowerPoint |
| deployment-operations | 部署、发布、回滚、健康检查与运行时排障 |
| production-statistics | 使用专用只读账号完成生产运营统计 |
| mihomo-proxy-setup | 安装和维护 Mihomo 开发代理 |
| github-create-issue | 创建自适应 SIES Issue Profile |
| github-issue-workflow | 从现有 GitHub 目标和证据恢复状态 |
| github-product-manager | 形成可评价的产品 Goal Contract |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 111 lines · 37 tokens per session scan A 5fbfff9af212
using-devkit is a skill published in the GitHub repository zhpeng24/devkit (2 stars, last pushed 1mo ago), licensed MIT. It adds 37 tokens to every session and 1,412 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…