Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zxpmail/reqforge/dev-buildernpx skills add zxpmail/ReqForge --skill dev-buildergit clone --depth 1 https://github.com/zxpmail/ReqForgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.03428 |
| Opus 5 | $0.00000 | $0.01714 |
| Sonnet 5 | $0.00000 | $0.00686 |
| Haiku 4.5 | $0.00000 | $0.00343 |
Grade A, and why
dev-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
name: dev-builder description: Used when DEV-PLAN.md is ready and the user says to start coding or continue developing the next Phase. Sets up the skeleton for new projects, implements features by Phase for existing projects. version: 1.2.0 updated: 2026-06-27 requires: []
[Task] Initialization Mode (0-to-1): No code + has DEV-PLAN.md -> set up project skeleton according to tech stack, install dependencies, configure development environment, complete Phase 1. Phase 1 的核心不是"写功能",是"放骨架": - 先写领域模型、核心类型定义、数据流接口 - 再写 Validator 模式、错误处理公约、中间件链 - 这些就是项目独有的"天理"——牛的骨节结构 - 后续所有 Phase 的代码都是从这些骨架生长出来的 - 所以 Phase 1 宁可慢一点把骨架放稳,也不要为了"快点看到功能"而跳过 - 骨架放好后,后续 Phase 的代码模型自然续写——因为"这个项目的代码长什么样"已经定了
**Continuous Development Mode**: Has code + has DEV-PLAN.md -> develop by Phase, **one Phase per /dev-builder invocation**. Each Phase: Plan Mode to plan implementation -> per-Task review + commit -> Phase four-step verification -> user confirmation -> **force stop** (suggests running **/code-review** for a holistic Phase-level review). User must call /dev-builder again for next Phase.
**Change-Scoped Mode**: Invoked from `/change-manager apply` with `change-name=<name>` -> read `changes/<name>/` (specs, design, tasks), execute **only** unchecked items in `changes/<name>/tasks.md`. Do not pull unrelated DEV-PLAN Phases. Still uses implementer + TDD + two-tier review per Task.
[Not For] - Fixing bugs in existing code -> use /bug-fixer instead - Reviewing code quality -> use /code-review instead - Planning development phases -> use /dev-planner instead - Gathering requirements -> use /product-spec-builder instead
[Dependency Check] Executed automatically as the first step when the Skill starts.
Required:
- Product-Spec.md -> if missing, prompt user to call /product-spec-builder first
- DEV-PLAN.md -> if missing, prompt user to call /dev-planner first
- All system tools and runtime environments listed in the DEV-PLAN tech stack table
Optional:
- Design-Brief.md -> if missing, mark as "no design specification mode"
- DESIGN.md -> if present, use frozen tokens for Tailwind/theme (priority over Brief for exact values)
- Design tool MCP -> if missing, mark as "no design draft mode"
- gh CLI -> if available, can automatically create GitHub repo and push
- playwright -> if available, can do UI automated testing
- **Dependency Graph** (`dep-graph`) -> if available, enables blast-radius analysis for impact assessment and risk-scored complexity gating
Installation Strategy:
- When required dependencies are missing or version requirements not met, the Agent autonomously determines the installation method and installs directly — no manual user operation needed
- If user permissions or interaction is needed, prompt the user to act
- When optional dependencies are missing, mark as degraded mode and continue working — do not block the workflow
[First Principles]
编码前必读 references/first-principles.md。TDD、implementer 隔离、验证即证据 — 非协商。
[Shared Discipline]
Karpathy 四原则 → ../_shared/karpathy-discipline.md(全文 core/docs/behavior-rules.md)
finding 的 action 三分(auto-fix/ask-user/no-op)驱动 Step 14.6 立即 escalate → ../_shared/finding-actions.md
[HARD-GATE]
主 Session MUST NOT 直接 Write/Edit 业务代码;每 Task dispatch implementer 并创建 .forge/implementer-session.json;首次改代码前 MUST git worktree。
**Exception 1 — UI / Integration Phase**: 主 session 可直接 Write/Edit,不强制 implementer 和 worktree。理由:UI 代码需要完整组件上下文,implementer 隔离得不偿失(Dogfood #2 验证)。
**Exception 2 — Small Phase (any Nature)**: 当 Phase 的 Key Files ≤3 且 Deliverables ≤5(即"Small Phase"),主 session 可直接 Write/Edit,不强制 implementer 和 worktree。理由:小型 Phase 的 implementer 冷启动开销 > 实际编码工作量(Dogfood #3 验证:Greenfield CLI 全部 5 Phase 均小到不值得隔离)。尺寸判定详见 `references/workflow.md` § Nature Gate Step 1.5。
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- commands/dev-builder.md 678 B
- references/anti-ai-slop-checklist.md 4.7 KB
- references/anti-rationalization.md 3.0 KB
- references/development-dimension-checklist.md 4.0 KB
- references/development-rules-checklist.md 10 KB
- references/development-strategies.md 5.4 KB
- references/first-principles.md 6.3 KB
- references/gc-audit-routing.md 2.4 KB
- references/phase-completion-assessment.md 9.6 KB
- references/sub-agent-isolation.md 4.9 KB
- references/workflow.md 32 KB
- references/zoom-out-pass.md 1.0 KB
- skill.json 926 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 205 lines · 0 tokens per session scan A 33e93e786860
dev-builder is a skill published in the GitHub repository zxpmail/ReqForge (18 stars, last pushed 12d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,428 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
chinese-documentation
中文文档排版参考——中英文空格、全半角标点、术语保留、链接格式、中文文案排版指北约定。仅在用户显式 /chinese-documentation 时调用,不要根据上下文自动触发。.
memorix-troubleshooting
Use when Memorix MCP, setup, project binding, HTTP control plane, hooks, skills, or agent integration is missing, stale, or failing.
subagent-driven-development
当在当前会话中执行包含独立任务的实现计划时使用.
orchestration-team
Operating manual for the orchestration pod. Covers lead vs peer roles, monitoring with rig commands, permission handling, implementation pair gating, dogfood loops, review routing, agent behavioral models, intervention discipline, and communication culture.
adr
Create and manage Architecture Decision Records. Documents significant technical decisions with context, alternatives, and consequences. Also supports evaluate (assess proposals) and design (system design) modes.
deploy-checklist
Pre-deployment verification checklist. Generates customized checklists based on tech-stack with rollback triggers. Auto-invoked by /draft:upload.