菜单
Context/token discipline: subagent isolation, output = summary, move-to-file, delegation threshold, lean skills. Trigger phrases: "token", "context", "context management", "context is full", "clear context"
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | token-budget |
| description | Context/token discipline: subagent isolation, output = summary, move-to-file, delegation threshold, lean skills. Trigger phrases: "token", "context", "context management", "context is full", "clear context" |
A subagent exists for context management: it runs in its own window and returns only its summary to the main thread — intermediate noise (file reads, searches, logs) never enters the main context.
Warning — measured, not guessed. Each subagent re-pays its full context from scratch: in a real
transcript the first turn was cache_read=0, every token cache_creation — nothing is shared with the main
thread's cache. A no-op subagent (task = "reply DONE") already cost ~10k tokens with restricted tools and
~16k with full tool access; that floor is base system prompt + tool schemas, paid fresh every time. Of the
always-on material only the skill listing (~2.5–3k tokens) is inherited by a subagent — the discipline
(DISCIPLINE.md/CLAUDE.md) and the agent descriptions are not injected into it. So a delegation is worth it
for isolation / parallelism / a clean window, or when the isolated work would otherwise cost the main thread
more than that ~10–16k floor — never by default.
docs/*.md; a summary + pointer comes back. (local, in gitignore)/clear.Measure output quality, don't vibe it: score a generative task with a two-layer grader — deterministic code metrics + per-dimension LLM-as-judge — over a fixed task set, as signed deltas vs a pinned baseline. Grades cost alongside correctness (pass-slow). Trigger phrases: "eval", "grader", "measure output quality", "LLM-as-judge", "score the output"
Stack-agnostic frontend discipline (web · mobile · desktop): component structure, state, data fetching, loading/empty/error states, i18n, accessibility, performance. frontend-expert-csk applies it on every stack. Trigger phrases: "frontend", "screen", "component", "page", "UI", "state management", "interface"
Refine-to-Done loop: repeat until tests green + review clean + nothing deferred; bounded. Not the harness /loop. Trigger phrases: "iterate", "loop until done", "keep going until"
Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws. Severity-ranked report with fixes. Trigger phrases: "security scan", "run a security scan", "OWASP check", "scan for vulnerabilities", "find security vulnerabilities", "security audit"
Scope a security audit BEFORE scanning, to cut false positives: map assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable THREAT_MODEL.md. A threat survives a patch; a vulnerability is only evidence for one. Feeds security-scan. Trigger phrases: "threat model", "attack surface", "scope the audit", "trust boundary"
SonarQube quality gate (language-agnostic, local-first): 0 Bugs/Vulns/Hotspots/Code Smells, 0 build warnings. If no analyzer exists, install the language's local server-less Sonar analyzer and run it — never a remote server. Trigger phrases: "sonarqube", "quality gate", "code smell", "sonar scan"