Token导航 LogoToken导航TokenDH.com
前端设计需要联网github未标认证来源可访问clear审计提醒

moai-foundation-core摩艾基础核心

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

1,822

周安装

73

GitHub Stars

964

下载量

590
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

3

许可证

MIT

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:moai-foundation-core(摩艾基础核心)
来源仓库:https://github.com/modu-ai/moai-adk
仓库路径:skills/moai-foundation-core
安装命令:
npx skills add https://github.com/modu-ai/moai-adk --skill moai-foundation-core
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。不同来源提供的安装方式可能略有差异;本站展示可直接复制的安装命令,安装前请核对来源页面。

skills.shnpx skills
npx skills add https://github.com/modu-ai/moai-adk --skill moai-foundation-core

简介

moai-foundation-core 用于辅助安全审计、权限检查和认证流程漏洞排查。

  • 适用于梳理敏感配置、分析鉴权逻辑或生成安全复核清单的场景。
  • 使用时不能将工具输出直接当作最终结论,需人工复核关键判断。
  • 涉及密钥、用户数据或生产系统时,应先确认最小权限和操作边界。
  • 适用宿主包括 Codex、Claude、Cursor、Gemini CLI,接入前应确认版本、权限和运行环境要求。

SKILL.md

MoAI Foundation Core

Foundational principles and architectural patterns that power MoAI-ADK's AI-driven development workflow.

Core Philosophy: Quality-first, domain-driven, modular, and efficient AI development through proven patterns and automated workflows.

Quick Reference

What is MoAI Foundation Core?

Six essential principles that ensure quality, efficiency, and scalability in AI-powered development:

  1. TRUST 5 Framework - Quality gate system (Tested, Readable, Unified, Secured, Trackable)
  2. SPEC-First DDD - Specification-driven domain-driven development workflow
  3. Delegation Patterns - Task orchestration via specialized agents (never direct execution)
  4. Token Optimization - 200K budget management and context efficiency
  5. Progressive Disclosure - Three-tier knowledge delivery (Quick, Implementation, Advanced)
  6. Modular System - File splitting and reference architecture for scalability

Quick Access:

  • Quality standards in modules/trust-5-framework.md
  • Development workflow in modules/spec-first-ddd.md
  • Agent coordination in modules/delegation-patterns.md
  • Budget management in modules/token-optimization.md
  • Content structure in modules/progressive-disclosure.md
  • File organization in modules/modular-system.md
  • Agent catalog in modules/agents-reference.md
  • Command reference in modules/commands-reference.md
  • Security and constraints in modules/execution-rules.md

Use Cases:

  • New agent creation with quality standards
  • New skill development with structural guidelines
  • Complex workflow orchestration
  • Token budget planning and optimization
  • Documentation architecture design
  • Quality gate configuration

Implementation Guide

1. TRUST 5 Framework - Quality Assurance System

Purpose: Automated quality gates ensuring code quality, security, and maintainability.

Five Pillars:

Tested Pillar: Maintain comprehensive test coverage with characterization tests ensuring behavior preservation. Execute pytest with coverage reporting. Block merge and generate missing tests on failure. Characterization tests capture current behavior for legacy code, while specification tests validate domain requirements for new code. High coverage ensures code reliability and reduces production defects. Preserves behavior during refactoring and reduces debugging time by 60-70 percent.

Readable Pillar: Use clear and descriptive naming conventions. Execute ruff linter checks. Issue warning and suggest refactoring improvements on failure. Clear naming improves code comprehension and team collaboration. Reduces onboarding time by 40 percent and improves maintenance velocity.

Unified Pillar: Apply consistent formatting and import patterns. Execute black formatter and isort checks. Auto-format code or issue warning on failure. Consistency eliminates style debates and merge conflicts. Reduces code review time by 30 percent and improves readability.

Secured Pillar: Comply with OWASP security standards. Execute security-expert agent analysis. Block merge and require security review on failure. Security vulnerabilities create critical business and legal risks. Prevents 95+ percent of common security vulnerabilities.

Trackable Pillar: Write clear and structured commit messages. Match Git commit message regex patterns. Suggest proper commit message format on failure. Clear history enables debugging, auditing, and collaboration. Reduces issue investigation time by 50 percent.

Integration Points: Pre-commit hooks for automated validation, CI/CD pipelines for quality gate enforcement, Agent workflows for core-quality validation, Documentation for quality metrics.

Detailed Reference: modules/trust-5-framework.md


2. SPEC-First DDD - Development Workflow

Purpose: Specification-driven development ensuring clear requirements before implementation.

Three-Phase Workflow:

Phase 1 SPEC (/moai:1-plan): workflow-spec generates EARS format. Output is.moai/specs/SPEC-XXX/spec.md. Execute /clear to save 45-50K tokens.

Phase 2 DDD (/moai:2-run): ANALYZE for requirements, PRESERVE for existing behavior, IMPROVE for enhancement. Validate with at least 85% coverage.

Phase 3 Docs (/moai:3-sync): API documentation, architecture diagrams, project reports.

EARS Format: Ubiquitous for system-wide always active requirements. Event-driven for trigger-based when X do Y requirements. State-driven for conditional while X do Y requirements. Unwanted for prohibited shall not do X requirements. Optional for nice-to-have where possible do X requirements.

Token Budget: SPEC takes 30K, DDD takes 180K, Docs takes 40K, Total is 250K.

Key Practice: Execute /clear after Phase 1 to initialize context.

Detailed Reference: modules/spec-first-ddd.md


3. Delegation Patterns - Agent Orchestration

Purpose: Task delegation to specialized agents, avoiding direct execution.

Core Principle: MoAI must delegate all work through Agent() to specialized agents. Direct execution bypasses specialization, quality gates, and token optimization. Proper delegation improves task success rate by 40 percent and enables parallel execution.

Delegation Syntax: Call Task with subagent_type parameter for specialized agent, prompt parameter for clear specific task, and context parameter with relevant data dictionary.

Three Patterns:

Sequential for dependencies: Call Task to api-designer for design, then Task to backend-expert for implementation with design context.

Parallel for independent work: Call Promise.all with Task to backend-expert and Task to frontend-expert simultaneously.

Conditional for analysis-based: Call Task to debug-helper for analysis, then based on analysis.type, call Task to security-expert or other appropriate agent.

Agent Selection: Simple tasks with 1 file use 1-2 agents sequential. Medium tasks with 3-5 files use 2-3 agents sequential. Complex tasks with 10+ files use 5+ agents mixed.

Detailed Reference: modules/delegation-patterns.md


4. Token Optimization - Budget Management

Purpose: Efficient 200K token budget through strategic context management.

Budget Allocation:

SPEC Phase takes 30K tokens. Strategy is to load requirements only and execute /clear after completion. Specification phase requires minimal context for requirement analysis. Saves 45-50K tokens for implementation phase.

DDD Phase takes 180K tokens. Strategy is selective file loading, load only implementation-relevant files. Implementation requires deep context but not full codebase. Enables 70 percent larger implementations within budget.

Docs Phase takes 40K tokens. Strategy is result caching and template reuse. Documentation builds on completed work artifacts. Reduces redundant file reads by 60 percent.

Total Budget is 250K tokens across all phases. Phase separation with context reset between phases provides clean context boundaries and prevents token bloat. Enables 2-3x larger projects within same budget.

Token Saving Strategies:

Phase Separation: Execute /clear between phases, after /moai:1-plan to save 45-50K, when context exceeds 150K, after 50+ messages.

Selective Loading: Load only necessary files.

Context Optimization: Target 20-30K tokens.

Model Selection: Sonnet for quality, Haiku for speed and cost with 70% cheaper rates for 60-70% total savings.

Detailed Reference: modules/token-optimization.md


5. Progressive Disclosure - Content Architecture

Purpose: Three-tier knowledge delivery balancing value with depth.

Three Levels:

Quick Reference Level: 30 seconds time investment, core principles and essential concepts, approximately 1,000 tokens. Rapid value delivery for time-constrained users. Users gain 80 percent understanding in 5 percent of time.

Implementation Level: 5 minutes time investment, workflows, practical examples, integration patterns, approximately 3,000 tokens. Bridges concept to execution with actionable guidance. Enables immediate productive work without deep expertise.

Advanced Level: 10+ minutes time investment, deep technical dives, edge cases, optimization techniques, approximately 5,000 tokens. Provides mastery-level knowledge for complex scenarios. Reduces escalations by 70 percent through comprehensive coverage.

SKILL.md Structure (maximum 500 lines): Quick Reference section, Implementation Guide section, Advanced Patterns section, Works Well With section.

Module Architecture: SKILL.md as entry point with cross-references, modules directory for deep dives with unlimited size, examples.md for working samples, reference.md for external links.

File Splitting when exceeding 500 lines: SKILL.md contains Quick at 80-120 lines, Implementation at 180-250 lines, Advanced at 80-140 lines, References at 10-20 lines. Overflow content goes to modules/topic.md.

Detailed Reference: modules/progressive-disclosure.md


6. Modular System - File Organization

Purpose: Scalable file structure enabling unlimited content.

Standard Structure: Create.claude/skills/skill-name/ directory containing SKILL.md as core file under 500 lines, modules directory for extended content with unlimited size including patterns.md, examples.md for working samples, reference.md for external links, scripts directory for utilities (optional), templates directory (optional).

File Principles: SKILL.md stays under 500 lines with progressive disclosure and cross-references. modules directory is topic-focused with no limits and self-contained content. examples.md is copy-paste ready with comments. reference.md contains API docs and resources.

Cross-Reference Syntax: Reference modules as Details in modules/patterns.md, reference examples as Examples in examples.md#auth, reference external docs as External in reference.md#api.

Discovery Flow: SKILL.md to Topic to modules/topic.md to Deep dive.

Detailed Reference: modules/modular-system.md


Advanced Implementation

Advanced patterns including cross-module integration, quality validation, and error handling are available in the detailed module references.

Key Advanced Topics:

  • Cross-Module Integration: Combining TRUST 5 + SPEC-First DDD
  • Token-Optimized Delegation: Parallel execution with context reset
  • Progressive Agent Workflows: Escalation patterns
  • Quality Validation: Pre/Post execution validation
  • Error Handling: Delegation failure recovery

Detailed Reference: examples.md for working code samples


Works Well With

Agents: agent-factory for creating agents with foundation principles, skill-factory for generating skills with modular architecture, core-quality for automated TRUST 5 validation, workflow-spec for EARS format specification, workflow-ddd for ANALYZE-PRESERVE-IMPROVE execution, workflow-docs for documentation with progressive disclosure.

Skills: moai-cc-claude-md for CLAUDE.md with foundation patterns, moai-cc-configuration for config with TRUST 5, moai-cc-memory for token optimization, moai-context7-integration for MCP integration.

Tools: AskUserQuestion for direct user interaction and clarification needs.

Commands: /moai:1-plan for SPEC-First Phase 1, /moai:2-run for DDD Phase 2, /moai:3-sync for Documentation Phase 3, /moai:9-feedback for continuous improvement, /clear for token management.

Foundation Modules (Extended Documentation): modules/agents-reference.md for 26-agent catalog with 7-tier hierarchy, modules/commands-reference.md for 6 core commands workflow, modules/execution-rules.md for security, Git strategy, and compliance.


Quick Decision Guide

New Agent: Primary principle is TRUST 5 and Delegation. Supporting principles are Token Optimization and Modular.

New Skill: Primary principle is Progressive and Modular. Supporting principles are TRUST 5 and Token Optimization.

Workflow: Primary principle is Delegation Patterns. Supporting principles are SPEC-First and Token Optimization.

Quality: Primary principle is TRUST 5 Framework. Supporting principle is SPEC-First DDD.

Budget: Primary principle is Token Optimization. Supporting principles are Progressive and Modular.

Docs: Primary principle is Progressive and Modular. Supporting principle is Token Optimization.

Module Deep Dives: modules/trust-5-framework.md, modules/spec-first-ddd.md, modules/delegation-patterns.md, modules/token-optimization.md, modules/progressive-disclosure.md, modules/modular-system.md, modules/agents-reference.md, modules/commands-reference.md, modules/execution-rules.md.

Full Examples: examples.md External Resources: reference.md

Common Rationalizations

RationalizationReality
"TRUST 5 is a guideline, not a gate"TRUST 5 is a HARD quality gate. All five dimensions must pass before completion.
"I can skip the SPEC for this small change"Every change without a SPEC is untracked. SPEC-less changes accumulate into unmanageable technical debt.
"Delegation to an agent is overhead for simple tasks"MoAI is an orchestrator, not an implementer. Skipping delegation bypasses domain expertise and quality checks.
"I will skip the quality gate, the code is clearly correct"Clearly correct code still needs evidence. Tests and linting are mechanisms; confidence is not.
"Progressive disclosure is not important for this project"Even small projects benefit from token-efficient skill loading. Disclosure is about context budget, not project size.

Red Flags

  • MoAI executing implementation code directly instead of delegating to an agent
  • TRUST 5 dimensions partially checked (only Tested and Readable, ignoring Secured)
  • SPEC document exists but has no acceptance criteria
  • Agent selected without consulting the selection decision tree
  • Quality gate skipped with "will check later" comment

Verification

  • All five TRUST 5 dimensions addressed (Tested, Readable, Unified, Secured, Trackable)
  • Agent selection documented with rationale matching the decision tree
  • SPEC document has acceptance criteria with observable evidence requirements
  • Delegation chain traceable: MoAI -> agent -> execution
  • Progressive disclosure levels configured in skill frontmatter

Token Budget (absorbed from moai-foundation-context)

Context window optimization, /clear strategy, session state persistence, and multi-agent handoff patterns.

Context Window Targets

Model classWindow75% threshold/clear trigger
Opus 4.7 (1M)1,000,000 tokens~750,000Above threshold
Sonnet/Opus standard200,000 tokens~150,000Above threshold
Haiku200,000 tokens~150,000Above threshold

Phase Token Allocation

PhaseBudgetStrategy
/moai plan30,000Load requirements only, /clear after completion
/moai run180,000Selective file loading, on-demand skill loading
/moai sync40,000Result caching, reduced redundant reads

/clear Strategy

Mandatory /clear points:

  1. After /moai plan completion (before /moai run)
  2. When context exceeds 150,000 tokens (Sonnet/standard)
  3. Before major phase transitions

Never use /clear when: In the middle of an agent task, when session state has not been persisted.

Session State Persistence

Before /clear, persist in-flight state to .moai/specs/<SPEC-ID>/progress.md:

  • Current task status (completed, in-progress, blocked)
  • File modification summary
  • Next action required
  • Resume message for paste-back after /clear

Resume message format:

Wave <N> 이어서 진행. SPEC-<ID>부터 <approach>.
progress.md: .moai/specs/<ID>/progress.md
다음 단계: <command>.

Multi-Agent Handoff

When delegating to a sub-agent near context ceiling:

  1. Summarize findings in progress.md before Agent() call
  2. Pass only necessary context in spawn prompt (avoid full file dumps)
  3. Sub-agent result contributes to parent context on return — factor this in
  4. If parent context > 120,000 tokens after return, save and /clear

Full optimization patterns: modules/token-budget-allocation.md

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

04

需要参考平台分布和安装热度时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

补充不同宿主或平台的使用分布数据

能力 5

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Claude Code

30.94%
按下载量换算183

Antigravity

21.67%
按下载量换算128

Codex

20.04%
按下载量换算118

Cursor

13.24%
按下载量换算78

OpenCode

8.08%
按下载量换算48

Gemini CLI

3.61%
按下载量换算21

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

可疑

权限和风险

需要联网

该 Skill 可能需要联网访问来源站点、仓库或外部 API;具体网络访问范围需要结合源码和 README 复核。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。来源安全扫描存在 warning/failed 结果,不能写成本站确认安全。

来源信息

继续浏览同类 Skills