Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zxc663/shisan-xinuo-workflow --skill shisan-xinuo-rolesgit clone --depth 1 https://github.com/zxc663/shisan-xinuo-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zxc663/shisan-xinuo-workflow/shisan-xinuo-roles)<a href="https://agentmods.dev/skills/zxc663/shisan-xinuo-workflow/shisan-xinuo-roles"><img src="https://agentmods.dev/badge/skills/zxc663/shisan-xinuo-workflow/shisan-xinuo-roles/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zxc663/shisan-xinuo-workflow/shisan-xinuo-roles"><img src="https://agentmods.dev/badge/skills/zxc663/shisan-xinuo-workflow/shisan-xinuo-roles.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.01047 |
| Opus 5.5 | $0.00069 | $0.00419 |
| Sonnet 5.5 | $0.00034 | $0.00209 |
| Haiku 4.5 | $0.00017 | $0.00105 |
Grade A, and why
shisan-xinuo-roles scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
角色包（shisan-xinuo-roles）
家族结构：本包=审查/执行角色层（身份×场景×流程×清单×出口×边界）；纪律与跑道（判级/门禁/红线/GATE）在核心
shisan-xinuo-workflow。依赖声明：本包假设核心在场——角色不含纪律条款，遇纪律问题以核心与注入核心为准（独立可装，建议同装）。
加载后行动契约（本包被加载时先做三件事）
- 触发确认：一行说明为什么加载本包（命中了哪个角色场景）。
- 选角色：按下方 dispatch 矩阵定位角色文件，读
roles/<角色>.md全文（六字段）。 - 出口产物：按该角色的⑤出口契约输出；委托子代理时主代理必须内联最小纪律包（子代理不继承注入副本，rules #28）。
dispatch 矩阵（症状/场景 → 角色）
| 场景/症状 | 角色 | 文件 |
|---|---|---|
| 方案/设计/规划评审 | 对抗式批评 | roles/critic.md |
| 提交/上线/迁移/破坏性变更前 | 风险评审 | roles/risk-reviewer.md |
| 密钥/权限/外部输入/依赖/发布（L3 类） | 安全审计 | roles/security-auditor.md |
| 报错/异常/行为不符（动手修之前） | 系统化排错（先根因后修复） | roles/debugger.md |
| 新端点/跨包对接/schema/序列化/中间层 | 对接契约 | roles/contract.md |
| 测试策略/边界覆盖/「跑通了」/验证降配 | 测试防假绿 | roles/test.md |
| UI/交互/样式/动效/图表 | 前端体验 | roles/frontend.md |
| 性能/耗时/并发卡顿/预算 | 性能（测量先于优化） | roles/perf.md |
六字段解剖学（角色文件统一骨架）
①身份与视角 ②适用场景/触发 ③所要求的流程 ④审查/执行清单（引用 details 编号，不复制正文——角色是细则的视图，防棘轮）⑤出口契约 ⑥能力边界（平台无 tools 白名单→prompt 声明降级）。
与核心/流程包对接
- 核心路由表「审查/验收」命中后加载本包；
shisan-xinuo-flows的规划/走查环节可 dispatch 到本包（critic 第 7 步前置、test 第 9 步验收）。 - 角色文件同时是平台子代理模板：复制到平台 agent 目录即可作为独立子代理使用（委托纪律包三件=主代理内联）。
边界
不复制纪律条款（单一源=核心）；不复制细则正文（单一源=details）；角色清单只增删映射维度，不改细则。
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed a49b9ca98433
- 4d ago Changed 98d5a053f0e2
- 6d ago Changed 2f781942e9ac
- 9d ago Changed 7fa265d57140
- 16d ago Changed 178f2ca681cc
- 23d ago Changed a3a7246a8c90
- 25d ago Changed cd301f041c94
- 26d ago Changed 50d700ab91e8
- 28d ago First seen · 51 lines · 172 tokens per session scan A 54ca702433a4
shisan-xinuo-roles is a skill published in the GitHub repository zxc663/shisan-xinuo-workflow (38 stars, last pushed 3d ago), licensed MIT. It adds 172 tokens to every session and 1,047 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-18.
Other skills, from other repositories
fix-bug
Fixes a bug through test-driven debugging, reproduces it with a failing test, locates the root cause with evidence (file:line), then applies the smallest fix that resolves it without refactoring unrelated code. Use when the user wants to fix a bug, debug an issue, resolve an error, or investigate a failing test. Not…
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
build-test
Run the project's build / typecheck / lint / test commands and emit the build.passing + tests.passing signals devloop convergence reads.
resolve-author-fix
Find the root cause, implement a focused fix, and prove behavior with targeted tests and recordings.
work
Deliver one maintainer-approved EmDash issue, choosing the bug-fix path for a defect and the direct implementation path for an enhancement or task.
behavior-contract
Bug condition/postcondition formalization as testable Behavior Contracts. Defines invariants that must be preserved across fixes.