dev-builder

dev-builder is a skill for Claude Code from zxpmail/ReqForge. It costs 0 tokens per session (3,428 once invoked), scanned A, original, MIT.

A development workflow that implements one planned project phase at a time from DEV-PLAN.md, the project's development plan.

In plain words
What is it for?
Use it to create the initial project structure, establish core types and error-handling patterns, or build the next planned phase of an existing project.
Why use it?
It gives coding work a defined order and stops after each phase so the result can be checked before more changes are made.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions subagents.

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is ../_shared/ # 跨 Skill 共享指针.

Good fit Use it to create the initial project structure, establish core types and error-handling patterns, or build the next planned phase of an existing project.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/zxpmail/ReqForge
agentmods
npx agentmods add skills/zxpmail/reqforge/dev-builder

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dev-builder

README.md
[![agentmods](https://agentmods.dev/badge/skills/zxpmail/reqforge/dev-builder/github.svg)](https://agentmods.dev/skills/zxpmail/reqforge/dev-builder)
Your own site
<a href="https://agentmods.dev/skills/zxpmail/reqforge/dev-builder"><img src="https://agentmods.dev/badge/skills/zxpmail/reqforge/dev-builder/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dev-builder

Your own site · 80×15
<a href="https://agentmods.dev/skills/zxpmail/reqforge/dev-builder"><img src="https://agentmods.dev/badge/skills/zxpmail/reqforge/dev-builder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,428 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Prompt Injection · line 1
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
  • high Prompt Injection · line 57
    Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
    Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
  • medium Excessive Agency · line 136
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.03428
Opus 5.5 $0.00000 $0.01371
Sonnet 5.5 $0.00000 $0.00686
Haiku 4.5 $0.00000 $0.00343

Measured 1mo ago against content hash 33e93e786860, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dev-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

adapters/claude-code/.claude/skills/dev-builder/SKILL.md · 205 lines

How it starts

The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.


name: dev-builder description: Used when DEV-PLAN.md is ready and the user says to start coding or continue developing the next Phase. Sets up the skeleton for new projects, implements features by Phase for existing projects. version: 1.2.0 updated: 2026-06-27 requires: []

[Task] Initialization Mode (0-to-1): No code + has DEV-PLAN.md -> set up project skeleton according to tech stack, install dependencies, configure development environment, complete Phase 1. Phase 1 的核心不是"写功能",是"放骨架": - 先写领域模型、核心类型定义、数据流接口 - 再写 Validator 模式、错误处理公约、中间件链 - 这些就是项目独有的"天理"——牛的骨节结构 - 后续所有 Phase 的代码都是从这些骨架生长出来的 - 所以 Phase 1 宁可慢一点把骨架放稳,也不要为了"快点看到功能"而跳过 - 骨架放好后,后续 Phase 的代码模型自然续写——因为"这个项目的代码长什么样"已经定了

**Continuous Development Mode**: Has code + has DEV-PLAN.md -> develop by Phase, **one Phase per /dev-builder invocation**. Each Phase: Plan Mode to plan implementation -> per-Task review + commit -> Phase four-step verification -> user confirmation -> **force stop** (suggests running **/code-review** for a holistic Phase-level review). User must call /dev-builder again for next Phase.

**Change-Scoped Mode**: Invoked from `/change-manager apply` with `change-name=<name>` -> read `changes/<name>/` (specs, design, tasks), execute **only** unchecked items in `changes/<name>/tasks.md`. Do not pull unrelated DEV-PLAN Phases. Still uses implementer + TDD + two-tier review per Task.

[Not For] - Fixing bugs in existing code -> use /bug-fixer instead - Reviewing code quality -> use /code-review instead - Planning development phases -> use /dev-planner instead - Gathering requirements -> use /product-spec-builder instead

[Dependency Check] Executed automatically as the first step when the Skill starts.

Required:
- Product-Spec.md -> if missing, prompt user to call /product-spec-builder first
- DEV-PLAN.md -> if missing, prompt user to call /dev-planner first
- All system tools and runtime environments listed in the DEV-PLAN tech stack table

Optional:
- Design-Brief.md -> if missing, mark as "no design specification mode"
- DESIGN.md -> if present, use frozen tokens for Tailwind/theme (priority over Brief for exact values)
- Design tool MCP -> if missing, mark as "no design draft mode"
- gh CLI -> if available, can automatically create GitHub repo and push
- playwright -> if available, can do UI automated testing
- **Dependency Graph** (`dep-graph`) -> if available, enables blast-radius analysis for impact assessment and risk-scored complexity gating

Installation Strategy:
- When required dependencies are missing or version requirements not met, the Agent autonomously determines the installation method and installs directly — no manual user operation needed
- If user permissions or interaction is needed, prompt the user to act
- When optional dependencies are missing, mark as degraded mode and continue working — do not block the workflow

[First Principles] 编码前必读 references/first-principles.md。TDD、implementer 隔离、验证即证据 — 非协商。

[Shared Discipline] Karpathy 四原则 → ../_shared/karpathy-discipline.md(全文 core/docs/behavior-rules.md) finding 的 action 三分(auto-fix/ask-user/no-op)驱动 Step 14.6 立即 escalate → ../_shared/finding-actions.md

[HARD-GATE] 主 Session MUST NOT 直接 Write/Edit 业务代码;每 Task dispatch implementer 并创建 .forge/implementer-session.json;首次改代码前 MUST git worktree。

**Exception 1 — UI / Integration Phase**: 主 session 可直接 Write/Edit,不强制 implementer 和 worktree。理由:UI 代码需要完整组件上下文,implementer 隔离得不偿失(Dogfood #2 验证)。

**Exception 2 — Small Phase (any Nature)**: 当 Phase 的 Key Files ≤3 且 Deliverables ≤5(即"Small Phase"),主 session 可直接 Write/Edit,不强制 implementer 和 worktree。理由:小型 Phase 的 implementer 冷启动开销 > 实际编码工作量(Dogfood #3 验证:Greenfield CLI 全部 5 Phase 均小到不值得隔离)。尺寸判定详见 `references/workflow.md` § Nature Gate Step 1.5。

Read the full file on GitHub · 205 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 205 lines · 0 tokens per session scan A 33e93e786860

Subscribe to this mod's changes

dev-builder is a skill published in the GitHub repository zxpmail/ReqForge (18 stars, last pushed 10d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,428 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.